2026-09-10_46832671ce6ff0b6b921730b5c32632b_cobalt-strike_icedid_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_46832671ce6ff0b6b921730b5c32632b_cobalt-strike_icedid_satacom
Size 48.8MB
Sample260910-vz8vcsshqc
SHA256 4de6bfe8c3f7bf8eb209937b22b8834ee6c10f04a03d59d9b5e75988d25cd9de
MD5 46832671ce6ff0b6b921730b5c32632b
SHA1 caeb79e10a2b2cf9b138ae41a40481816346dc6b
SHA512 d49839d89ac5c1c7115b5968af24dbf0b012b5b00c00da193f2c40dacc86fa5c8a076176076f252fd0a266b1879ccdc147d90f7785bf1c38e108df3f5da5ee8d
SSDEEP 786432:SW+YgQAnLxSsOPYrYYxwENxsvNcnv4dJGWm:SWtgQAnLxSbmxBLsvegdJzm
TLSH
T101B7D09B931DF01E5BDBA293B88A47A11D2AD13895D338498DDEE35CA7934FC43E7210
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-10_46832671ce6ff0b6b921730b5c32632b_cobalt-strike_icedid_satacom

File Explorer

2026-09-10_46832671ce6ff0b6b921730b5c32632b_cobalt-strike_icedid_satacom

.exe 48.8MB

2026-09-10_46832671ce6ff0b6b921730b5c32632b_cobalt-strike_icedid_satacom

IMPHASH e8cc83f192cb38420ce998689c53db1a
SHA256 4de6bfe8c3f7bf8eb209937b22b8834ee6c10f04a03d59d9b5e75988d25cd9de
MD5 46832671ce6ff0b6b921730b5c32632b
SHA1 caeb79e10a2b2cf9b138ae41a40481816346dc6b
SHA512 d49839d89ac5c1c7115b5968af24dbf0b012b5b00c00da193f2c40dacc86fa5c8a076176076f252fd0a266b1879ccdc147d90f7785bf1c38e108df3f5da5ee8d
SSDEEP 786432:SW+YgQAnLxSsOPYrYYxwENxsvNcnv4dJGWm:SWtgQAnLxSbmxBLsvegdJzm
TLSH
T101B7D09B931DF01E5BDBA293B88A47A11D2AD13895D338498DDEE35CA7934FC43E7210
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

58768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetFilePointerEx WriteFile CloseHandle SetUnhandledExceptionFilter GetLastError SetLastError SetErrorMode AddVectoredExceptionHandler RemoveVectoredExceptionHandler QueryPerformanceCounter HeapAlloc HeapFree GetProcessHeap SetEvent WaitForSingleObject CreateEventW Sleep GetCurrentProcess GetCurrentProcessId GetExitCodeProcess CreateProcessW ProcessIdToSessionId FlushInstructionCache GetSystemInfo GetTickCount VirtualAlloc VirtualProtect VirtualFree QueueUserWorkItem ReadFile GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetModuleHandleExA GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryA LoadLibraryW LocalFree lstrcmpW lstrcpynA lstrcpyW lstrcatW lstrlenW CopyFileW MoveFileExW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetFileSizeEx DeleteFileW CreateFileW CreateDirectoryW GetCurrentDirectoryW GetCommandLineW SetCurrentDirectoryW SetEnvironmentVariableW GetEnvironmentVariableW FreeLibrary LCMapStringW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle ExitProcess TerminateProcess GetModuleHandleExW IsValidCodePage RtlCaptureContext RtlVirtualUnwind GetConsoleWindow UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW LoadLibraryExW

user32

wsprintfW TranslateMessage MsgWaitForMultipleObjects PeekMessageW DispatchMessageW

advapi32

RegSetValueExW ConvertStringSidToSidW ConvertSidToStringSidW RegDeleteTreeW RegCreateKeyExW RegCloseKey GetSidSubAuthorityCount GetSidSubAuthority CreateProcessAsUserW

shell32

ShellExecuteExW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Name

.text

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.data

Size

48.6MB

Virtual Size

48.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_46832671ce6ff0b6b921730b5c32632b_cobalt-strike_icedid_satacom

kernel32

user32

advapi32

shell32

userenv

generic