2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc
Size 15.8MB
Sample260922-3d95ashg49
SHA256 4d4d0f27b095cdf7f70cf91cf7c1de06671f19708010517f4b495f86fc9874c3
MD5 f66e854cfcd34bf0a26a2514babb0cbd
SHA1 12c1daac7c8584ab1fb5dd853e38dd7f652b5b82
SHA512 9c0294f2199c0e8996df1fdef96f390fb48756e235ea9f539c6ada0a13c74f2a5b2e81b9cad62f6ac4f7b728877a3eb21e303f7c6c7a29907385b9d6346f567e
SSDEEP 196608:K1cnk0blImIujKHo869Ts/KU2Sz0hGVLhpK2ftfWiwRQjX:nnk0blSksnFz0hGZhpK2luhO
TLSH
T1C0F69D45F2A251E8D57BC038C266A617FB7038BD43146AF79AD19A646F23BD06E3F700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc

.exe 15.8MB

2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 797ca6037eae7a889582531ccdd81cd4
SHA256 4d4d0f27b095cdf7f70cf91cf7c1de06671f19708010517f4b495f86fc9874c3
MD5 f66e854cfcd34bf0a26a2514babb0cbd
SHA1 12c1daac7c8584ab1fb5dd853e38dd7f652b5b82
SHA512 9c0294f2199c0e8996df1fdef96f390fb48756e235ea9f539c6ada0a13c74f2a5b2e81b9cad62f6ac4f7b728877a3eb21e303f7c6c7a29907385b9d6346f567e
SSDEEP 196608:K1cnk0blImIujKHo869Ts/KU2Sz0hGVLhpK2ftfWiwRQjX:nnk0blSksnFz0hGZhpK2luhO
TLSH
T1C0F69D45F2A251E8D57BC038C266A617FB7038BD43146AF79AD19A646F23BD06E3F700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12266240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

kernel32

GetCurrentThreadId ReleaseMutex OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTickCount64 GetLastError Process32NextW K32GetProcessMemoryInfo GetCurrentThread QueryPerformanceFrequency Process32FirstW CloseHandle CreateThread ExitProcess GetComputerNameW GetCurrentProcessId CreateProcessW WideCharToMultiByte QueryFullProcessImageNameW CreateProcessA SetProcessWorkingSetSize QueryPerformanceCounter GetTickCount MoveFileW GetProcessTimes GetExitCodeProcess ReleaseSRWLockExclusive AcquireSRWLockExclusive InitOnceBeginInitialize InitOnceComplete WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW WaitForSingleObjectEx InitializeSRWLock GetFileAttributesW GetModuleHandleW GetProcAddress FreeLibrary LoadLibraryExA LoadLibraryExW GetSystemDirectoryW CreateEventA GetStdHandle GetConsoleMode WriteConsoleW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetProcessAffinityMask GetSystemTimeAsFileTime LoadLibraryA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindFirstFileExW GetFullPathNameW GetACP IsValidCodePage HeapQueryInformation HeapSize HeapReAlloc SetEndOfFile SetStdHandle GetTimeZoneInformation OutputDebugStringW ReadConsoleW GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale CreateFileW WaitForSingleObject CreateMutexA FindClose CreatePipe SetThreadPriority GetModuleFileNameW TerminateProcess ExpandEnvironmentStringsW WriteFile GetCurrentProcess InitializeConditionVariable FindNextFileW SetPriorityClass SetHandleInformation GetFileSizeEx FindFirstFileW GetLogicalDrives ReadFile CreateDirectoryW SetEnvironmentVariableW GetProcessHeap GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect HeapFree HeapAlloc GetLogicalProcessorInformationEx SetFilePointerEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetFileType GetModuleHandleExW FreeLibraryAndExitThread ExitThread IsProcessorFeaturePresent FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer GetOEMCP RtlUnwind EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection

user32

GetSystemMetrics MessageBoxW GetDC GetDesktopWindow GetIconInfo FillRect EnumDisplayMonitors GetWindowTextW SendInput ReleaseDC SetProcessDPIAware DrawIconEx wsprintfW OpenInputDesktop GetForegroundWindow GetMonitorInfoA GetCursorInfo CloseDesktop GetAsyncKeyState GetThreadDesktop SetThreadDesktop

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetStockObject GetDIBits DeleteDC SetDIBitsToDevice GetObjectW SetStretchBltMode DeleteObject

advapi32

RegSetValueExW RegOpenKeyExW RegCloseKey RegQueryValueExA RegCreateKeyExW GetTokenInformation OpenProcessToken RegOpenKeyExA

shell32

ShellExecuteExW SHFileOperationW ShellExecuteW

ole32

CoInitializeEx CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance CoUninitialize

oleaut32

VariantClear VariantInit

d3d11

D3D11CreateDevice

ws2_32

freeaddrinfo WSAGetLastError htons getsockopt recv connect socket send WSAStartup getaddrinfo select closesocket ioctlsocket setsockopt WSACleanup

gdiplus

GdiplusStartup GdiplusShutdown GdipCreateBitmapFromScan0 GdipSaveImageToStream GdipGetImageEncodersSize GdipBitmapLockBits GdipFree GdipDisposeImage GdipAlloc GdipBitmapUnlockBits GdipCloneImage GdipGetImageEncoders

d3dcompiler_47

D3DCompile

rstrtmgr

RmEndSession RmGetList RmStartSession RmRegisterResources

winmm

waveInPrepareHeader waveInStop waveInGetNumDevs waveInReset waveInUnprepareHeader waveInGetDevCapsW waveInOpen waveInStart waveInAddBuffer timeBeginPeriod waveInClose

Name

.text

Size

12.0MB

Virtual Size

12.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

8.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

304KB

Virtual Size

304KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_f66e854cfcd34bf0a26a2514babb0cbd_cobalt-strike_icedid_njrat_satacom_stealc

bcrypt

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

d3d11

ws2_32

gdiplus

d3dcompiler_47

rstrtmgr

winmm

generic