2026-09-10_54fc8c3560740ee3bb71421f97747c73_cobalt-strike_icedid_njrat_satacom

General

Target
2026-09-10_54fc8c3560740ee3bb71421f97747c73_cobalt-strike_icedid_njrat_satacom
Size 65.3MB
Sample260910-vadmxsdg76
SHA256 508392b14b67831c6e14c397cb177ad77283ef317c233da781d7a8873728e7ad
MD5 54fc8c3560740ee3bb71421f97747c73
SHA1 e3d3add20857eb27213488e149540deda4f094ec
SHA512 f92c5d2e3265d87359c7831e964a68eddf603c33a46d38e7a45c3ea2f8c270537ed47086760a78636add4a6f40a0dbb9664e90182e5cbcfb6e4be372265cc688
SSDEEP 786432:bIBTOkj/R9PD23vr4bSfsa6vpCm6SazMDaxsszNmSLX9ZsNQ:bnkj/Hr3RpjGxlm8r
TLSH
T1A6E7868DA7493E02B929B6D2D01F525E4C8DFA98471902C6FF810DA71C1E0B4D6DBBB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-10_54fc8c3560740ee3bb71421f97747c73_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-09-10_54fc8c3560740ee3bb71421f97747c73_cobalt-strike_icedid_njrat_satacom

.exe 65.3MB

2026-09-10_54fc8c3560740ee3bb71421f97747c73_cobalt-strike_icedid_njrat_satacom

IMPHASH 4d10f6f6c7f1828f0b6590266b63f072
SHA256 508392b14b67831c6e14c397cb177ad77283ef317c233da781d7a8873728e7ad
MD5 54fc8c3560740ee3bb71421f97747c73
SHA1 e3d3add20857eb27213488e149540deda4f094ec
SHA512 f92c5d2e3265d87359c7831e964a68eddf603c33a46d38e7a45c3ea2f8c270537ed47086760a78636add4a6f40a0dbb9664e90182e5cbcfb6e4be372265cc688
SSDEEP 786432:bIBTOkj/R9PD23vr4bSfsa6vpCm6SazMDaxsszNmSLX9ZsNQ:bnkj/Hr3RpjGxlm8r
TLSH
T1A6E7868DA7493E02B929B6D2D01F525E4C8DFA98471902C6FF810DA71C1E0B4D6DBBB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

13760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcess GetCurrentThread GetThreadContext FreeLibrary GetModuleHandleA GetProcAddress FlushInstructionCache VirtualAlloc GetTickCount GetSystemDirectoryA MapViewOfFile UnmapViewOfFile CreateFileMappingA VirtualProtect VirtualFree RtlAddFunctionTable DeleteFileA FlushFileBuffers SetFileAttributesA WriteFile GetTempPathA GetTempFileNameA GetLastError WaitForSingleObject Sleep GetExitCodeProcess CreateThread CreateProcessW GetModuleFileNameA MoveFileA MoveFileExA MultiByteToWideChar GetCurrentProcessId LoadResource LockResource SizeofResource FindResourceA DuplicateHandle QueryPerformanceCounter WriteConsoleW CreateFileW GetConsoleMode GetConsoleOutputCP HeapSize SetFilePointerEx GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose LCMapStringW CompareStringW LoadLibraryExW HeapReAlloc GetFileType WideCharToMultiByte HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetCommandLineW GetCommandLineA GetModuleFileNameW GetStdHandle GetModuleHandleExW CloseHandle FreeConsole CreateFileA GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader ExitProcess TerminateProcess

user32

MessageBoxA

ncrypt

BCryptGenRandom

shell32

ShellExecuteW

Name

.text

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

65.2MB

Virtual Size

65.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_54fc8c3560740ee3bb71421f97747c73_cobalt-strike_icedid_njrat_satacom

kernel32

user32

ncrypt

shell32

generic