2026-09-21_dec9221246c6691e1eee060d8870aac6_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-21_dec9221246c6691e1eee060d8870aac6_cobalt-strike_icedid_njrat_satacom_stealc
Size 4.5MB
Sample260922-llly1ada69
SHA256 c38d8d56ce779caa8ab7f4d2443cebc1ae02c4509df19ac32694a8e91a4d04a4
MD5 dec9221246c6691e1eee060d8870aac6
SHA1 91d15b3ba0ad4c8d9f260b955c9d68132bb0cbfd
SHA512 239202f78c62089774b22a1dfe9922ba366871d93dc6b64f78625b78f91bf20e6b8286f693bdbc8fd52ece8fa22cfa800cb96b28288af207d26a14ea1912c02d
SSDEEP 98304:10tjwajvqlkOxZajUxykEFcM9GNu3MaH0U3:8jwGv1KuUxyV6Nu8aUU
TLSH
T197262305F69880F1D4A7263C88328A94B7323DA5F7B1D7DB6B15BF982F372D44938A11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-21_dec9221246c6691e1eee060d8870aac6_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-09-21_dec9221246c6691e1eee060d8870aac6_cobalt-strike_icedid_njrat_satacom_stealc

.exe 4.5MB

2026-09-21_dec9221246c6691e1eee060d8870aac6_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH c1928a5eec980aaeae162c1c3f3c2324
SHA256 c38d8d56ce779caa8ab7f4d2443cebc1ae02c4509df19ac32694a8e91a4d04a4
MD5 dec9221246c6691e1eee060d8870aac6
SHA1 91d15b3ba0ad4c8d9f260b955c9d68132bb0cbfd
SHA512 239202f78c62089774b22a1dfe9922ba366871d93dc6b64f78625b78f91bf20e6b8286f693bdbc8fd52ece8fa22cfa800cb96b28288af207d26a14ea1912c02d
SSDEEP 98304:10tjwajvqlkOxZajUxykEFcM9GNu3MaH0U3:8jwGv1KuUxyV6Nu8aUU
TLSH
T197262305F69880F1D4A7263C88328A94B7323DA5F7B1D7DB6B15BF982F372D44938A11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

108752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegOpenKeyExW RegCloseKey

ole32

CoUninitialize CoInitializeEx

oleaut32

VariantInit SysAllocString SafeArrayPutElement VariantClear SysFreeString SafeArrayCreate SafeArrayDestroy SafeArrayAccessData SafeArrayUnaccessData

user32

MessageBoxW GetWindowTextW GetWindowTextA RedrawWindow EnumWindows GetWindowThreadProcessId ReleaseDC GetSystemMetrics IsWindowVisible SetWindowPos ShowWindow InvalidateRect MessageBoxA GetDC

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

shell32

SHGetFolderPathW

ws2_32

WSACleanup WSAStartup

gdi32

GetDeviceCaps

kernel32

HeapReAlloc HeapSize GetConsoleOutputCP GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW CompareStringW LoadLibraryExW GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineA GetModuleHandleExW WriteConsoleW GetStdHandle GetCommandLineW GetEnvironmentVariableA GetEnvironmentVariableW SetEnvironmentVariableA SetEnvironmentVariableW CreateFileA CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileAttributesA GetFileAttributesW GetFileSizeEx ReadFile SetFileAttributesW SetFilePointer SetFilePointerEx WriteFile GetTempPathW CloseHandle SetHandleInformation GetLastError SetLastError CreatePipe QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess SwitchToThread CreateThread GetCurrentThread GetCurrentThreadId OpenThread SuspendThread CreateProcessW GetThreadContext OpenProcess GlobalMemoryStatusEx GetSystemTimeAsFileTime GetLocalTime GetTickCount64 GetSystemDirectoryW GetNativeSystemInfo VirtualProtect MapViewOfFile FlushViewOfFile UnmapViewOfFile GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryA LoadLibraryW CreateFileMappingA OpenFileMappingA QueryFullProcessImageNameW MoveFileExW GetComputerNameA MultiByteToWideChar GetConsoleMode SetConsoleMode GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW Thread32First Thread32Next K32EnumProcessModules ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead FreeLibrary RtlPcToFileHeader RaiseException RtlUnwindEx RtlLookupFunctionEntry FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx DeleteCriticalSection IsProcessorFeaturePresent ExitProcess

Name

.text

Size

205KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fpdata

Size

512B

Virtual Size

136B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.falcon

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tweaks

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-21_dec9221246c6691e1eee060d8870aac6_cobalt-strike_icedid_njrat_satacom_stealc

advapi32

ole32

oleaut32

user32

version

shell32

ws2_32

gdi32

kernel32

generic