2026-09-04_3811e55500b17ef401b2ce2f9a28a173_cobalt-strike_icedid_njrat_satacom

General

Target
2026-09-04_3811e55500b17ef401b2ce2f9a28a173_cobalt-strike_icedid_njrat_satacom
Size 363KB
Sample260905-rf5f2swemd
SHA256 bdf373cf81e2a9c99b36e56753e3540f81a6a9f032034146a3f71dae3341f139
MD5 3811e55500b17ef401b2ce2f9a28a173
SHA1 f4ef4ecf16b48e9efe743bca249390a63ce595fd
SHA512 c52962cbd886f913f999b181ef0344aabc2f5c422c66c13fb6e386f6ce0edead8cbdc5d96517bab539b0426df9c80bcb1435cf6b1ed85c1aa9c623b82866d42e
SSDEEP 6144:53Qs3RxjFdXH5T33pXV3iPrnClcyvmgk+8eKStMyrtJteXxQ2iaao:fBj3pXyrXyvn4GVDteXC2j
TLSH
T1DF848D15EBA400FAE1B7D178C9A24906DB72FC5A0771AACF03A446971F276E09F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_3811e55500b17ef401b2ce2f9a28a173_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-09-04_3811e55500b17ef401b2ce2f9a28a173_cobalt-strike_icedid_njrat_satacom

.exe 363KB

2026-09-04_3811e55500b17ef401b2ce2f9a28a173_cobalt-strike_icedid_njrat_satacom

IMPHASH 66d1b1516d645e81816e4acc80891737
SHA256 bdf373cf81e2a9c99b36e56753e3540f81a6a9f032034146a3f71dae3341f139
MD5 3811e55500b17ef401b2ce2f9a28a173
SHA1 f4ef4ecf16b48e9efe743bca249390a63ce595fd
SHA512 c52962cbd886f913f999b181ef0344aabc2f5c422c66c13fb6e386f6ce0edead8cbdc5d96517bab539b0426df9c80bcb1435cf6b1ed85c1aa9c623b82866d42e
SSDEEP 6144:53Qs3RxjFdXH5T33pXV3iPrnClcyvmgk+8eKStMyrtJteXxQ2iaao:fBj3pXyrXyvn4GVDteXC2j
TLSH
T1DF848D15EBA400FAE1B7D178C9A24906DB72FC5A0771AACF03A446971F276E09F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

164048

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winhttp

WinHttpOpen WinHttpSendRequest WinHttpConnect WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpCloseHandle

kernel32

GetStringTypeW SetEndOfFile WriteConsoleW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA CloseHandle ExpandEnvironmentStringsW ReadFile SetFilePointer WaitForSingleObject CreateFileW GetLastError CreateProcessW WriteFile CreateNamedPipeW PeekNamedPipe GetCurrentThreadId Sleep GetCurrentProcessId WideCharToMultiByte GetTickCount ConnectNamedPipe GetModuleHandleW CreateProcessA GetComputerNameA LocalFree FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW SetFileInformationByHandle GetTempPathW CreateFile2 AreFileApisANSI GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx RtlUnwind GetCPInfo QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW HeapReAlloc RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType GetFileSizeEx SetFilePointerEx GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW IsValidCodePage GetACP GetOEMCP

Name

.text

Size

336KB

Virtual Size

336KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_3811e55500b17ef401b2ce2f9a28a173_cobalt-strike_icedid_njrat_satacom

version

winhttp

kernel32

generic