2026-08-30_ce776d81d097b3051818f879ea050cab_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-30_ce776d81d097b3051818f879ea050cab_cobalt-strike_icedid_njrat_ryuk_satacom_stealc
Size 53.2MB
Sample260831-erapladj4x
SHA256 8b256626ddd788a47abee4505dbb834c6856cfb418a596f0bc46a4c67d8ca7d1
MD5 ce776d81d097b3051818f879ea050cab
SHA1 f51cca805f47b84575843c2f594dfb4c1a465adf
SHA512 e9d5be909b0e4ad062c6a63527f641ae7cc7982948bdd4720741aef2138b55ed388ec0275927ce39342b560281a22e97d66f4d32caba8467becadd2e4f830dc3
SSDEEP 786432:j2q9i61Jix1xTs4ea9Wy/UWkbKRFjOamd/MuoTod1Aqw/n:yqx1Jix04eaLceRFjOFEu2oEqw/n
TLSH
T182C712D691D192F4C3E26070628E139BB8E134794A7C586F7BC21C136B30EEA995DF27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-30_ce776d81d097b3051818f879ea050cab_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

File Explorer

2026-08-30_ce776d81d097b3051818f879ea050cab_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

.exe 53.2MB

2026-08-30_ce776d81d097b3051818f879ea050cab_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

IMPHASH db87bd6c67ea4a982f683ad5ec22496c
SHA256 8b256626ddd788a47abee4505dbb834c6856cfb418a596f0bc46a4c67d8ca7d1
MD5 ce776d81d097b3051818f879ea050cab
SHA1 f51cca805f47b84575843c2f594dfb4c1a465adf
SHA512 e9d5be909b0e4ad062c6a63527f641ae7cc7982948bdd4720741aef2138b55ed388ec0275927ce39342b560281a22e97d66f4d32caba8467becadd2e4f830dc3
SSDEEP 786432:j2q9i61Jix1xTs4ea9Wy/UWkbKRFjOamd/MuoTod1Aqw/n:yqx1Jix04eaLceRFjOFEu2oEqw/n
TLSH
T182C712D691D192F4C3E26070628E139BB8E134794A7C586F7BC21C136B30EEA995DF27
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard EnableWindow EnumWindows FindWindowA FindWindowW GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetSystemMetrics GetWindowTextA GetWindowTextLengthA IsWindow IsWindowUnicode IsWindowVisible LoadCursorW MessageBoxA MonitorFromWindow MsgWaitForMultipleObjects OpenClipboard PeekMessageW PostQuitMessage RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetProcessDPIAware SetWindowPos SetWindowsHookW ShowWindow TrackMouseEvent TranslateMessage UnregisterClassW UpdateWindow

kernel32

AcquireSRWLockExclusive AllocConsole AreFileApisANSI BeginUpdateResourceW CheckRemoteDebuggerPresent CloseHandle CopyFileW CreateDirectoryA CreateDirectoryW CreateFile2 CreateFileA CreateFileW CreateMutexW CreatePipe CreateProcessA CreateProcessW CreateRemoteThread CreateRemoteThreadEx CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EncodePointer EndUpdateResourceW EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameA GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetFileAttributesExW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetLastError GetLocaleInfoA GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemFirmwareTable GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetThreadContext GetTickCount GetTickCount64 GetUserDefaultLCID GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32GetModuleFileNameExA LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree LockResource MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA Process32FirstW Process32NextW QueryFullProcessImageNameA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleTitleA SetEndOfFile SetEvent SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetThreadPriority SetThreadPriorityBoost SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SystemTimeToFileTime TerminateProcess UnhandledExceptionFilter UnmapViewOfFile UpdateResourceW VerSetConditionMask VirtualAlloc VirtualAllocEx VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile GetSystemTimeAsFileTime CreateEventA GetModuleHandleA TerminateProcess CreateToolhelp32Snapshot Thread32First GetCurrentProcessId GetCurrentThreadId OpenThread Thread32Next CloseHandle SuspendThread ResumeThread WriteProcessMemory GetSystemInfo VirtualAlloc VirtualProtect VirtualFree GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask Sleep GetTickCount LoadLibraryA SystemTimeToFileTime FileTimeToSystemTime GlobalFree FreeLibrary HeapAlloc HeapFree GetProcAddress ExitProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar GetModuleHandleW LoadResource FindResourceExW FindResourceExA WideCharToMultiByte GetThreadLocale GetUserDefaultLCID GetSystemDefaultLCID EnumResourceNamesA EnumResourceNamesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceTypesA EnumResourceTypesW CreateFileW LoadLibraryW GetLastError FlushFileBuffers FlsSetValue GetCommandLineA GetCPInfo GetACP GetOEMCP IsValidCodePage EncodePointer DecodePointer FlsGetValue FlsFree SetLastError FlsAlloc GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RaiseException RtlPcToFileHeader RtlUnwindEx SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapSetInformation HeapCreate HeapDestroy QueryPerformanceCounter LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize WriteFile SetFilePointer GetConsoleCP GetConsoleMode HeapReAlloc InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA GetModuleHandleA LoadLibraryA GetProcAddress HeapAlloc HeapFree ExitProcess

advapi32

CloseServiceHandle ControlService ConvertSidToStringSidA CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptDestroyKey CryptEncrypt CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext CryptVerifySignatureA GetUserNameA LookupAccountNameA OpenSCManagerA OpenServiceA QueryServiceStatus RegCloseKey RegCreateKeyExA RegCreateKeyW RegDeleteTreeW RegOpenKeyExA RegOpenKeyW RegQueryValueExA RegSetKeyValueW RegSetValueExA

shell32

CommandLineToArgvW SHChangeNotify SHGetFolderPathA ShellExecuteW

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoSetProxyBlanket CoUninitialize

gdi32

CreateRectRgn DeleteObject GetDeviceCaps

iphlpapi

GetAdaptersAddresses

ntdll

NtQuerySystemInformation RtlInitUnicodeString

ws2_32

WSACleanup WSAStartup closesocket connect freeaddrinfo getaddrinfo recv send socket

secur32

AcquireCredentialsHandleW DecryptMessage DeleteSecurityContext EncryptMessage FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW

dxgi

CreateDXGIFactory1

d3dcompiler_47

D3DCompile

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3d11

D3D11CreateDeviceAndSwapChain

crypt32

CryptBinaryToStringA CryptDecodeObjectEx CryptImportPublicKeyInfo CryptStringToBinaryA

Name

.text

Size

5.8MB

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

832KB

Virtual Size

832KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1008KB

Virtual Size

1008KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.8KX

Size

15.7MB

Virtual Size

15.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.x0}

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.KNe

Size

29.7MB

Virtual Size

29.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.l1

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-30_ce776d81d097b3051818f879ea050cab_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

user32

kernel32

advapi32

shell32

oleaut32

ole32

gdi32

iphlpapi

ntdll

ws2_32

secur32

dxgi

d3dcompiler_47

dwmapi

imm32

d3d11

crypt32

generic