2026-09-23_c70207d902775ad14429523b89d924dc_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-09-23_c70207d902775ad14429523b89d924dc_cobalt-strike_icedid_njrat_satacom_stealc
Size 783KB
Sample260924-bz3tkabd34
SHA256 723a05c7363e72ed625c3a5c2f4cd3ce01539fd50c2fb4110ef9518d6431427c
MD5 c70207d902775ad14429523b89d924dc
SHA1 161a4a79535dc06baefa933115cc97368af23dc0
SHA512 0ca75550829943bb69f2500d8ce884a161a694099792086042b0c36bc39141ee2dd414fd1228ffa403f40923bfe8feb66115ba63e1c7188cc4ae449f93374e63
SSDEEP 12288:EAWPUoAzUSJWsOrD87JNKkO/is+VPakUis7CyEb0CrQHPT2+8CqLrxBZ8Ry72Vkn:7WSvb6sS4LaEa1YQLABs8J
TLSH
T1AD058D36B6AC41F9D167E17A89964506F3F27846033197CB53904A6A1F2B6F86F3F320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_c70207d902775ad14429523b89d924dc_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-09-23_c70207d902775ad14429523b89d924dc_cobalt-strike_icedid_njrat_satacom_stealc

.exe 783KB

2026-09-23_c70207d902775ad14429523b89d924dc_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 66aadee638e2bf96a3dc7ee4584cc33e
SHA256 723a05c7363e72ed625c3a5c2f4cd3ce01539fd50c2fb4110ef9518d6431427c
MD5 c70207d902775ad14429523b89d924dc
SHA1 161a4a79535dc06baefa933115cc97368af23dc0
SHA512 0ca75550829943bb69f2500d8ce884a161a694099792086042b0c36bc39141ee2dd414fd1228ffa403f40923bfe8feb66115ba63e1c7188cc4ae449f93374e63
SSDEEP 12288:EAWPUoAzUSJWsOrD87JNKkO/is+VPakUis7CyEb0CrQHPT2+8CqLrxBZ8Ry72Vkn:7WSvb6sS4LaEa1YQLABs8J
TLSH
T1AD058D36B6AC41F9D167E17A89964506F3F27846033197CB53904A6A1F2B6F86F3F320
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

327488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\LocalProject\FileSearch\FileSearch\Release\FileSearchService.pdb

kernel32

FlushFileBuffers SetUnhandledExceptionFilter ConnectNamedPipe GetDriveTypeW WaitNamedPipeW WideCharToMultiByte GetCurrentProcessId LocalFree GetOverlappedResult GetLocalTime CancelIoEx CloseHandle SetEvent GetLastError Sleep MultiByteToWideChar CreateEventW DisconnectNamedPipe GetCurrentThreadId CreateFileW WaitForSingleObject GetTempPathW SetErrorMode WaitForMultipleObjects CreateNamedPipeW GetModuleFileNameW TerminateProcess WriteFile GetCurrentProcess SetNamedPipeHandleState GetLogicalDrives SetEndOfFile ReadFile WriteConsoleW HeapSize GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 GetModuleHandleW GetProcAddress GetFileInformationByHandleEx FormatMessageA GetLocaleInfoEx QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc GetConsoleOutputCP GetConsoleMode HeapFree VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetTimeZoneInformation GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle RtlUnwind

advapi32

QueryServiceStatusEx OpenServiceW StartServiceCtrlDispatcherW StartServiceW ControlService SetServiceObjectSecurity DeleteService SetServiceStatus OpenSCManagerW CloseServiceHandle CreateServiceW RegisterServiceCtrlHandlerExW ConvertStringSecurityDescriptorToSecurityDescriptorW

filesearch

?Running@AutoFileSearch@fsengine@@QEBA_NXZ ?LogLine@fsengine@@YAX$$QEAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?Search@AutoFileSearch@fsengine@@QEAA?AV?$vector@USearchResult@fsengine@@V?$allocator@USearchResult@fsengine@@@std@@@std@@V?$basic_string_view@_WU?$char_traits@_W@std@@@4@AEBUAutoFileSearchOptions@2@@Z ?Status@AutoFileSearch@fsengine@@QEBA?AUAutoFileSearchStatus@2@XZ ?ReleaseFacts@AutoFileSearch@fsengine@@QEAAXXZ ?Stop@AutoFileSearch@fsengine@@QEAAXXZ ?StopMft@AutoFileSearch@fsengine@@QEAAXXZ ?StopSearch@AutoFileSearch@fsengine@@QEAAXXZ ?StartSearchAsync@AutoFileSearch@fsengine@@QEAA_NPEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?StartMftAsync@AutoFileSearch@fsengine@@QEAA_NPEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?StartSearch@AutoFileSearch@fsengine@@QEAA_NPEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?StartMft@AutoFileSearch@fsengine@@QEAA_NPEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?ConfigureSearch@AutoFileSearch@fsengine@@QEAA_NUAutoFileSearchConfig@2@PEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?Configure@AutoFileSearch@fsengine@@QEAA_NUAutoFileSearchConfig@2@PEAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ??1AutoFileSearch@fsengine@@QEAA@XZ ?RebuildNgramIndexesIfNeeded@AutoFileSearch@fsengine@@QEAAXXZ ??0AutoFileSearch@fsengine@@QEAA@UAutoFileSearchConfig@1@@Z

dbghelp

MiniDumpWriteDump

Name

.text

Size

545KB

Virtual Size

544KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_c70207d902775ad14429523b89d924dc_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

advapi32

filesearch

dbghelp

generic