2026-09-16_a77fa8cad052a1238b87c26bf7297066_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-09-16_a77fa8cad052a1238b87c26bf7297066_cobalt-strike_icedid_njrat_satacom_stealc
Size 345KB
Sample260916-w1827ateqb
SHA256 0d888f47716cbfc05900f69ccf7f827e1435be2f8f72d270a436d13f76eae9f9
MD5 a77fa8cad052a1238b87c26bf7297066
SHA1 4d07b53aab4233ed844546af62b1624283ea73a5
SHA512 98bdc71ae5a05780e29dd1826769c15fb08ee6a495d4085232246a5029cd5540959ef44e3e59577c12b0f5303c8799d3ee7105d3675d0f127f665f7b80c1408d
SSDEEP 3072:cwQ0w43Yv/MsFYlFsQcJL+o2icLaHHi12PUr28K6UbXd20begL4CjNCxFiwE+aHM:czosHQaHp+K6UbXd2Weg80M1sy1TlW
TLSH
T1C2747D66F76414FDE1B7D5B8C9664902EB727C4A03706ACF339019A22F276E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_a77fa8cad052a1238b87c26bf7297066_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-09-16_a77fa8cad052a1238b87c26bf7297066_cobalt-strike_icedid_njrat_satacom_stealc

.exe 345KB

2026-09-16_a77fa8cad052a1238b87c26bf7297066_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 3ca90afbe05846a9255aa55c67775953
SHA256 0d888f47716cbfc05900f69ccf7f827e1435be2f8f72d270a436d13f76eae9f9
MD5 a77fa8cad052a1238b87c26bf7297066
SHA1 4d07b53aab4233ed844546af62b1624283ea73a5
SHA512 98bdc71ae5a05780e29dd1826769c15fb08ee6a495d4085232246a5029cd5540959ef44e3e59577c12b0f5303c8799d3ee7105d3675d0f127f665f7b80c1408d
SSDEEP 3072:cwQ0w43Yv/MsFYlFsQcJL+o2icLaHHi12PUr28K6UbXd20begL4CjNCxFiwE+aHM:czosHQaHp+K6UbXd2Weg80M1sy1TlW
TLSH
T1C2747D66F76414FDE1B7D5B8C9664902EB727C4A03706ACF339019A22F276E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

85184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpSetOption WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpOpen

advapi32

GetUserNameA

crypt32

CryptUnprotectData CryptStringToBinaryA

kernel32

GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap CreateFileW HeapSize WriteConsoleW SetEndOfFile InitializeSListHead GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW HeapReAlloc DeleteFileA FindClose FindFirstFileA FindNextFileA GetFileAttributesA GetTempPathA IsDebuggerPresent CloseHandle GetLastError CreateMutexA GetCurrentProcess ExitProcess GetProcAddress LocalFree CopyFileA GetComputerNameA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime RtlUnwind SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetOEMCP RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW TerminateProcess FreeLibrary GetModuleHandleExW RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapFree WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW GetTimeZoneInformation HeapAlloc VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW CreateDirectoryW IsValidCodePage GetACP

Name

.text

Size

242KB

Virtual Size

241KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_a77fa8cad052a1238b87c26bf7297066_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

advapi32

crypt32

kernel32

generic