2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.9MB
Sample260922-2mf25sys5j
SHA256 eb26c85c60590c7012dd4128e4f310ca6e009d0bc84138ea9969209abb298931
MD5 0889d61a9afad5decb6e8b0858490c5b
SHA1 0d51a13fc070c511178dd6451479f63cd447c4b7
SHA512 06d4d0d10ff93fb36836a6d3200c906c0d15528d323082d23cf239dfc3a436c956a3c132c8745c487e20de88911f2c5a14a5e44083a3ccb389b7dab3039b90d3
SSDEEP 24576:Tunw9qbcKPwTeg3EkCpq+qWJIBuVdDExTL9+vgd7rnBgLyT/dKXVQGlGqeBRxB:Tuw9qbrWKXiBkExTsgdvnBT5KXmqib
TLSH
T11795F14082B415F5F17396F8C6FAAB0675707883BB2109D31A82D6EFD9B1CB0D8356A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.9MB

2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH e83a1a7f7cdbd277106e0fc484456418
SHA256 eb26c85c60590c7012dd4128e4f310ca6e009d0bc84138ea9969209abb298931
MD5 0889d61a9afad5decb6e8b0858490c5b
SHA1 0d51a13fc070c511178dd6451479f63cd447c4b7
SHA512 06d4d0d10ff93fb36836a6d3200c906c0d15528d323082d23cf239dfc3a436c956a3c132c8745c487e20de88911f2c5a14a5e44083a3ccb389b7dab3039b90d3
SSDEEP 24576:Tunw9qbcKPwTeg3EkCpq+qWJIBuVdDExTL9+vgd7rnBgLyT/dKXVQGlGqeBRxB:Tuw9qbrWKXiBkExTsgdvnBT5KXmqib
TLSH
T11795F14082B415F5F17396F8C6FAAB0675707883BB2109D31A82D6EFD9B1CB0D8356A7
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

43264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHGetFolderPathA ShellExecuteA

user32

LoadCursorA DestroyWindow SetWindowPos GetSystemMetrics ShowWindow GetWindowTextA SetWindowTextA GetMessageA DefWindowProcA CreateWindowExA SetFocus TranslateMessage SendMessageA SystemParametersInfoA GetClientRect PostQuitMessage DispatchMessageA RegisterClassA

gdi32

GetStockObject SetTextColor SetBkColor CreateSolidBrush CreateFontA

advapi32

GetTokenInformation OpenProcessToken

kernel32

GetProcessHeap LCMapStringW FlushFileBuffers VirtualProtect ReadFile ReadConsoleW CreateFileW HeapSize WriteConsoleW HeapReAlloc SetEndOfFile LoadLibraryExW GetModuleHandleW GetModuleFileNameA SizeofResource Process32First FindFirstFileA GetCurrentProcess WriteFile TerminateProcess FindNextFileA FindResourceA FindClose WaitForSingleObject UnmapViewOfFile GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep GetTempPathA GetFileAttributesA CreateFileA GetSystemDirectoryA LoadLibraryA LockResource DeleteFileA Process32Next CloseHandle CreateThread LoadResource SetFileAttributesA GetProcAddress CreateFileMappingA GetCurrentProcessId GlobalMemoryStatusEx CreateProcessA GetDiskFreeSpaceExA MapViewOfFile GetTickCount GetComputerNameA QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetStringTypeW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle GetModuleFileNameW ExitProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent HeapFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc GetFileType GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle

Name

.text

Size

139KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_0889d61a9afad5decb6e8b0858490c5b_cobalt-strike_icedid_njrat_satacom_stealc

shell32

user32

gdi32

advapi32

kernel32

generic