2026-09-09_d253a31a21a6d91c3958c49cd0b723ba_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-09_d253a31a21a6d91c3958c49cd0b723ba_cobalt-strike_icedid_njrat_satacom_stealc
Size 305KB
Sample260910-24sr9sxclf
SHA256 11db652095abfe193306e29164342735aeb7c6bdccb51a966c97253535c61b7f
MD5 d253a31a21a6d91c3958c49cd0b723ba
SHA1 26dfc2d94a2c5a8f10ddf14edb6acecccc7c8274
SHA512 c7f4c76fe1848e75b3a6ba05b729debd8fc75d79947a0eb582df2d07c6f11d796592f0bc6e9d25bcd6f1ff01df41ee8e579f8e83210a928405886dc49af03f81
SSDEEP 3072:6eAxjQBULkLjstRcnU6s1OB/N8MdRsr5xBP5LKDmVb9CeNHsjHvd8yMGTHYHOtKi:67xQc1u18aClHgSja+HXMCBW
TLSH
T19A648D15F7A914F9EA77923CC9524506FA727C524760DACF03A04AAA2F237E09E3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-09_d253a31a21a6d91c3958c49cd0b723ba_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-09-09_d253a31a21a6d91c3958c49cd0b723ba_cobalt-strike_icedid_njrat_satacom_stealc

.exe 305KB

2026-09-09_d253a31a21a6d91c3958c49cd0b723ba_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 60420083cbef850f46902f930a3679de
SHA256 11db652095abfe193306e29164342735aeb7c6bdccb51a966c97253535c61b7f
MD5 d253a31a21a6d91c3958c49cd0b723ba
SHA1 26dfc2d94a2c5a8f10ddf14edb6acecccc7c8274
SHA512 c7f4c76fe1848e75b3a6ba05b729debd8fc75d79947a0eb582df2d07c6f11d796592f0bc6e9d25bcd6f1ff01df41ee8e579f8e83210a928405886dc49af03f81
SSDEEP 3072:6eAxjQBULkLjstRcnU6s1OB/N8MdRsr5xBP5LKDmVb9CeNHsjHvd8yMGTHYHOtKi:67xQc1u18aClHgSja+HXMCBW
TLSH
T19A648D15F7A914F9EA77923CC9524506FA727C524760DACF03A04AAA2F237E09E3F711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\source\repos\sosk\x64\Release\sosk.pdb

kernel32

GetFileSize GetCurrentProcessId GlobalMemoryStatusEx CreateProcessA GetSystemTimeAsFileTime GetTickCount GetProcAddress SetEndOfFile WriteConsoleW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW GetSystemInfo CloseHandle DeleteFileW DeleteFileA MultiByteToWideChar GetTempPathA GetModuleHandleA CreateFileW WaitForSingleObject TerminateProcess VirtualFree GetComputerNameA ReadFile FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW FindClose HeapReAlloc QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive Sleep GetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer WideCharToMultiByte LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetExitCodeProcess CreateProcessW GetFileAttributesExW ReadConsoleW IsValidCodePage GetACP GetOEMCP RtlUnwind

user32

DestroyWindow GetDC CreateWindowExA ReleaseDC

gdi32

CreatePen Rectangle DeleteObject CreateSolidBrush SelectObject

advapi32

RegDeleteKeyA RegCreateKeyExA RegSetValueExA RegOpenKeyExA RegEnumValueA RegCloseKey

urlmon

URLDownloadToCacheFileW

winhttp

WinHttpCloseHandle WinHttpReceiveResponse WinHttpOpenRequest WinHttpSendRequest WinHttpReadData WinHttpOpen WinHttpConnect

Name

.text

Size

197KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-09_d253a31a21a6d91c3958c49cd0b723ba_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

gdi32

advapi32

urlmon

winhttp

generic