2026-09-04_8375cfc5bd840213f20eaca0b5a95005_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_8375cfc5bd840213f20eaca0b5a95005_cobalt-strike_icedid_njrat_ryuk_satacom_stealc
Size 2.0MB
Sample260905-fp2wqseq6y
SHA256 629bb593e6eca1eb7bf8ea15b00822610f2c60caf0c734943b346d6f3c991140
MD5 8375cfc5bd840213f20eaca0b5a95005
SHA1 c90e28894e0878ef94cbe33bfeaecc01e7346af5
SHA512 290e8ad5e4edea03922c0d3ee9df0be4a7794bfc98e379d6b548bf09b95dc20c6738804dfa52e02af9a2a94ad54784b6d45a325c36063f40528d07e6ebb7cb3b
SSDEEP 24576:rfW0ZeiRk8T/NGnqi/mEz62luyO4LbcATFYlj46Az/xx/srbOjRK8rSC6R:Dx28T/NjGucu+bcATFYlj4N/P4bUzSR
TLSH
T13DA56C07F25660FDC49AC174974B5623AA71748A0B34BDEF4280D6362F7AAF01F7A724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_8375cfc5bd840213f20eaca0b5a95005_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

File Explorer

2026-09-04_8375cfc5bd840213f20eaca0b5a95005_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

.exe 2.0MB

2026-09-04_8375cfc5bd840213f20eaca0b5a95005_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

IMPHASH 153c41444cda2e0d8c262740796019f2
SHA256 629bb593e6eca1eb7bf8ea15b00822610f2c60caf0c734943b346d6f3c991140
MD5 8375cfc5bd840213f20eaca0b5a95005
SHA1 c90e28894e0878ef94cbe33bfeaecc01e7346af5
SHA512 290e8ad5e4edea03922c0d3ee9df0be4a7794bfc98e379d6b548bf09b95dc20c6738804dfa52e02af9a2a94ad54784b6d45a325c36063f40528d07e6ebb7cb3b
SSDEEP 24576:rfW0ZeiRk8T/NGnqi/mEz62luyO4LbcATFYlj46Az/xx/srbOjRK8rSC6R:Dx28T/NjGucu+bcATFYlj4N/P4bUzSR
TLSH
T13DA56C07F25660FDC49AC174974B5623AA71748A0B34BDEF4280D6362F7AAF01F7A724
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1620320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts WinHttpWebSocketClose WinHttpWebSocketCompleteUpgrade WinHttpWebSocketReceive WinHttpWebSocketSend

ws2_32

WSAStartup closesocket connect freeaddrinfo getaddrinfo recv send socket

crypt32

CryptBinaryToStringA CryptStringToBinaryA CryptUnprotectData

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontW CreateSolidBrush DeleteDC DeleteObject GetDIBits GetDeviceCaps GetStockObject GetTextExtentPoint32W IntersectClipRect SelectClipRgn SelectObject SetBkMode SetDIBits SetStretchBltMode SetTextColor StretchBlt TextOutW

gdiplus

GdipCreateBitmapFromFile GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipGetImageEncoders GdipGetImageEncodersSize GdipGetImageHeight GdipGetImageWidth GdipSaveImageToStream GdiplusStartup

shell32

CommandLineToArgvW ExtractIconExW SHGetFolderPathW SHGetKnownFolderPath SetCurrentProcessExplicitAppUserModelID ShellExecuteExW Shell_NotifyIconW

user32

AttachThreadInput BringWindowToTop CallNextHookEx ChildWindowFromPointEx CloseClipboard CreateDesktopW CreateWindowExW DefWindowProcW DestroyIcon DestroyWindow DispatchMessageW DrawIconEx EmptyClipboard EnableMenuItem EnumDesktopWindows EnumDisplayDevicesW EnumDisplayMonitors EnumDisplaySettingsW EnumWindows ExitWindowsEx FillRect FindWindowExW FindWindowW GetAncestor GetClipboardData GetDC GetDlgItem GetFocus GetForegroundWindow GetKeyState GetKeyboardState GetLastInputInfo GetMessageW GetSystemMenu GetSystemMetrics GetWindowDC GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId InvalidateRect IsWindow IsWindowVisible LoadCursorW LoadIconW LockWorkStation MapVirtualKeyW MessageBoxW MoveWindow MsgWaitForMultipleObjects OpenClipboard OpenDesktopW PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW PrintWindow RegisterClassW ReleaseDC ScreenToClient SendMessageW SetClipboardData SetCursorPos SetFocus SetForegroundWindow SetLayeredWindowAttributes SetThreadDesktop SetWindowDisplayAffinity SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoW ToUnicode TranslateMessage UnhookWindowsHookEx UnregisterClassW UpdateWindow WindowFromPoint keybd_event mouse_event

advapi32

AdjustTokenPrivileges GetUserNameW InitiateSystemShutdownExW LookupPrivilegeValueW OpenProcessToken RegCloseKey RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

ole32

CoCreateInstance CoInitializeEx CoSetProxyBlanket CoTaskMemFree CoUninitialize CreateStreamOnHGlobal PropVariantClear

oleaut32

SysAllocStringByteLen SysFreeString SysStringByteLen

winmm

mciSendStringW waveInAddBuffer waveInClose waveInGetDevCapsW waveInGetNumDevs waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader

mfplat

MFCreateAttributes MFCreateMediaType MFCreateSourceResolver MFShutdown MFStartup

mf

MFCreateAudioRendererActivate MFCreateMediaSession MFCreateTopology MFCreateTopologyNode MFCreateVideoRendererActivate MFEnumDeviceSources

mfreadwrite

MFCreateSourceReaderFromMediaSource

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateFileA CreateFileMappingW CreateFileW CreateMutexW CreatePipe CreateProcessW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileA DeleteFileW DeleteProcThreadAttributeList EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetComputerNameW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileSize GetFileSizeEx GetFileType GetFullPathNameA GetFullPathNameW GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetShortPathNameW GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempFileNameW GetTempPathA GetTempPathW GetTickCount GetTickCount64 GetTimeZoneInformation GetUserDefaultLCID GetVolumeInformationW GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LocalFree LockFile LockFileEx MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFilePointer SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SystemTimeToFileTime TerminateProcess UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile UpdateProcThreadAttribute VirtualProtect WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcmpiW

d3d11

D3D11CreateDevice

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

249KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.frtslp

Size

512B

Virtual Size

195B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_8375cfc5bd840213f20eaca0b5a95005_cobalt-strike_icedid_njrat_ryuk_satacom_stealc

winhttp

ws2_32

crypt32

bcrypt

gdi32

gdiplus

shell32

user32

advapi32

ole32

oleaut32

winmm

mfplat

mf

mfreadwrite

kernel32

d3d11

generic