2026-09-03_8ccb08d0c0b5d8d9f185c0f8d97f4dea_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-09-03_8ccb08d0c0b5d8d9f185c0f8d97f4dea_cobalt-strike_icedid_njrat_satacom_stealc
Size 503KB
Sample260905-2v2nta1vbs
SHA256 e6ec26b1f058077f73ef037d33ba140ec39bf18310b81f72991500d32b5d7b16
MD5 8ccb08d0c0b5d8d9f185c0f8d97f4dea
SHA1 8c27f0043045c0b8c827dc106539fccb5e1b4345
SHA512 66a8b471d5db575498062a2e9aaba85a110dfe1200fc4b3df160a6060f080816b74aec1795bed482c997d59e60bc67813ad3810cba0f1d9f72633192430ab249
SSDEEP 6144:bpkqV62NhPM9ibPzbW0VGZd1mJQImFSuazqgeBka0jLbLAX:9khlmJQImAuaWzX
TLSH
T124B4A3269C5A51E0C3F9D374C6791409BDB2BA40473057FFA09AF5275EB61E2B838F88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-03_8ccb08d0c0b5d8d9f185c0f8d97f4dea_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-09-03_8ccb08d0c0b5d8d9f185c0f8d97f4dea_cobalt-strike_icedid_njrat_satacom_stealc

.exe 503KB

2026-09-03_8ccb08d0c0b5d8d9f185c0f8d97f4dea_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 4c4bec9d9fea01d7c4abddd204a684b2
SHA256 e6ec26b1f058077f73ef037d33ba140ec39bf18310b81f72991500d32b5d7b16
MD5 8ccb08d0c0b5d8d9f185c0f8d97f4dea
SHA1 8c27f0043045c0b8c827dc106539fccb5e1b4345
SHA512 66a8b471d5db575498062a2e9aaba85a110dfe1200fc4b3df160a6060f080816b74aec1795bed482c997d59e60bc67813ad3810cba0f1d9f72633192430ab249
SSDEEP 6144:bpkqV62NhPM9ibPzbW0VGZd1mJQImFSuazqgeBka0jLbLAX:9khlmJQImAuaWzX
TLSH
T124B4A3269C5A51E0C3F9D374C6791409BDB2BA40473057FFA09AF5275EB61E2B838F88
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

329696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

wsprintfA

kernel32

FlsGetValue WriteConsoleW CreateFileA CreateFileW CloseHandle GetProcessHeap Sleep GetCurrentProcess GetCurrentProcessId CreateThread GetCurrentThread GetCurrentThreadId GetThreadContext FlushInstructionCache GetSystemInfo GetTickCount GetSystemDirectoryW VirtualProtect VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile SetProcessWorkingSetSize GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryA LoadLibraryW MultiByteToWideChar ReleaseSRWLockExclusive AcquireSRWLockExclusive InitOnceBeginInitialize InitOnceComplete QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead SetEnvironmentVariableW HeapReAlloc HeapSize ReadConsoleW ReadFile GetStringTypeW SetStdHandle RaiseException GetLastError SetLastError FlsAlloc FreeEnvironmentStringsW FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection IsProcessorFeaturePresent ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree LoadLibraryExW CompareStringW LCMapStringW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RtlVirtualUnwind RtlUnwind

Name

.text

Size

418KB

Virtual Size

418KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CRT

Size

512B

Virtual Size

184B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-03_8ccb08d0c0b5d8d9f185c0f8d97f4dea_cobalt-strike_icedid_njrat_satacom_stealc

user32

kernel32

ntdll

generic