2026-09-04_20ff44927eaafbe43b564e20b33727d5_cobalt-strike_icedid_njrat_satacom

General

Target
2026-09-04_20ff44927eaafbe43b564e20b33727d5_cobalt-strike_icedid_njrat_satacom
Size 65.3MB
Sample260905-t5yqxaeh52
SHA256 e8a9422d4fb29c880d26510210b7e269097d4f0dc8c9ca3f5727c3c70690b1cd
MD5 20ff44927eaafbe43b564e20b33727d5
SHA1 4ef2c925eb2659a9ec1baed0b39f614e4e569cd0
SHA512 944da8abf4cc3bb76dc048916c2a99219aa6bedc84182648055902aa06c66495787a73c1cb33c299c2d36a487cd0d9d2a3e3d932fde525c1a75f2e9721d4c47b
SSDEEP 786432:2SCiWDn+TkbRUcnzo08Kca0H8gs+v3ErTpAH0RQ0tlkk/v:2SpWyen98ZaCay3Q1QmrH
TLSH
T123E7869B5CDD037FEFBF7B6A20AF4175C3AD68230348615052E28A254B5D962A35BF30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_20ff44927eaafbe43b564e20b33727d5_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-09-04_20ff44927eaafbe43b564e20b33727d5_cobalt-strike_icedid_njrat_satacom

.exe 65.3MB

2026-09-04_20ff44927eaafbe43b564e20b33727d5_cobalt-strike_icedid_njrat_satacom

IMPHASH 5da9460f8df7b39023af2c1ce0a27a9a
SHA256 e8a9422d4fb29c880d26510210b7e269097d4f0dc8c9ca3f5727c3c70690b1cd
MD5 20ff44927eaafbe43b564e20b33727d5
SHA1 4ef2c925eb2659a9ec1baed0b39f614e4e569cd0
SHA512 944da8abf4cc3bb76dc048916c2a99219aa6bedc84182648055902aa06c66495787a73c1cb33c299c2d36a487cd0d9d2a3e3d932fde525c1a75f2e9721d4c47b
SSDEEP 786432:2SCiWDn+TkbRUcnzo08Kca0H8gs+v3ErTpAH0RQ0tlkk/v:2SpWyen98ZaCay3Q1QmrH
TLSH
T123E7869B5CDD037FEFBF7B6A20AF4175C3AD68230348615052E28A254B5D962A35BF30
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

10896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileA GetCurrentThread CloseHandle GetThreadContext GetProcAddress FreeLibrary VirtualAlloc FlushInstructionCache GetTickCount UnmapViewOfFile GetSystemDirectoryA CreateFileMappingA MapViewOfFile VirtualProtect VirtualFree GetModuleFileNameA WriteFile RtlAddFunctionTable WaitForSingleObject MultiByteToWideChar Sleep GetTempPathA GetLastError MoveFileExA DeleteFileA SetFileAttributesA GetCurrentProcessId CreateProcessW FlushFileBuffers GetExitCodeProcess SizeofResource GetCommandLineW FindResourceA LockResource LoadResource LocalFree GetModuleHandleA QueryPerformanceCounter WriteConsoleW CreateFileW GetConsoleMode GetConsoleOutputCP HeapSize SetFilePointerEx GetProcessHeap GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose LCMapStringW LoadLibraryExW GetFileType HeapReAlloc HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WideCharToMultiByte IsProcessorFeaturePresent GetModuleHandleExW TerminateProcess GetCurrentProcess ExitProcess GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW

shell32

CommandLineToArgvW ShellExecuteW

Name

.text

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

65.2MB

Virtual Size

65.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_20ff44927eaafbe43b564e20b33727d5_cobalt-strike_icedid_njrat_satacom

kernel32

shell32

generic