2026-09-22_4868560fbabf3a42f2bb25aea5983deb_cobalt-strike_icedid_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-22_4868560fbabf3a42f2bb25aea5983deb_cobalt-strike_icedid_satacom
Size 170KB
Sample260922-jf6ecaba85
SHA256 373c06db18f69e35be5424d95a4cc6d737cda7ccd1e967cceb0007e68d819fc2
MD5 4868560fbabf3a42f2bb25aea5983deb
SHA1 1b2a3204e437f33b4b08bd7faac42859c97a575f
SHA512 157c13ac5ac4d0a721c655979408b438d1ed78e5e3a230a462d11e78bad827f98395e777e6b1568e3f1b697cb374eb2654ddc31ab15403870ea222ce96f9f45a
SSDEEP 3072:WxuJ08F05nuLGalBDMQOrBx+yWdaHM1BDH90VH:cuNxGaHDcBM8V
TLSH
T1A9040806F7E611F9E177C23986621626BB72782403305BEF57600B765F22BD4EE39B90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-22_4868560fbabf3a42f2bb25aea5983deb_cobalt-strike_icedid_satacom

File Explorer

2026-09-22_4868560fbabf3a42f2bb25aea5983deb_cobalt-strike_icedid_satacom

.exe 170KB

2026-09-22_4868560fbabf3a42f2bb25aea5983deb_cobalt-strike_icedid_satacom

IMPHASH 0a045728a00956b975e7047018abc4b7
SHA256 373c06db18f69e35be5424d95a4cc6d737cda7ccd1e967cceb0007e68d819fc2
MD5 4868560fbabf3a42f2bb25aea5983deb
SHA1 1b2a3204e437f33b4b08bd7faac42859c97a575f
SHA512 157c13ac5ac4d0a721c655979408b438d1ed78e5e3a230a462d11e78bad827f98395e777e6b1568e3f1b697cb374eb2654ddc31ab15403870ea222ce96f9f45a
SSDEEP 3072:WxuJ08F05nuLGalBDMQOrBx+yWdaHM1BDH90VH:cuNxGaHDcBM8V
TLSH
T1A9040806F7E611F9E177C23986621626BB72782403305BEF57600B765F22BD4EE39B90
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

59872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW FlushFileBuffers GetFileSizeEx ReadFile SetFileAttributesW SetFilePointerEx WriteFile GetTempPathW CloseHandle GetLastError SetLastError SetErrorMode HeapAlloc HeapFree GetProcessHeap SetEvent WaitForSingleObject CreateEventW Sleep GetCurrentProcess GetCurrentProcessId GetExitCodeProcess CreateThread CreateProcessW GetEnvironmentVariableW FlushInstructionCache OpenProcess SetProcessInformation VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateJobObjectW AssignProcessToJobObject SetInformationJobObject GetModuleFileNameW lstrcmpW lstrcmpiW lstrcpynW lstrcpyW lstrcatW lstrlenW CopyFileW MoveFileExW CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteConsoleW GetConsoleMode GetConsoleOutputCP HeapReAlloc HeapSize LCMapStringW ProcessIdToSessionId GetCommandLineW LoadLibraryExW VirtualProtect GetStringTypeW GetFileType SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineA GetCPInfo GetOEMCP QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsValidCodePage RtlCaptureContext RtlVirtualUnwind GetConsoleWindow UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP

user32

PeekMessageW MsgWaitForMultipleObjects GetSystemMetrics wsprintfW TranslateMessage DispatchMessageW

advapi32

GetTokenInformation

shell32

ShellExecuteExW

bcrypt

BCryptGetProperty BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptSetProperty BCryptDestroyKey BCryptCloseAlgorithmProvider

ole32

CoInitializeEx CoRegisterClassObject CoCreateInstance CoResumeClassObjects CoUninitialize

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

Name

.text

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_4868560fbabf3a42f2bb25aea5983deb_cobalt-strike_icedid_satacom

kernel32

user32

advapi32

shell32

bcrypt

ole32

oleaut32

generic