2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom
Size 3.6MB
Sample260924-ckdfssbg83
SHA256 d9740220c7a6ecc00a8851aaf76bae458b353b7ab3fd8019406eed1d7286097b
MD5 b70387607e4f6a9be549f85658d1ad5b
SHA1 6ee83614da9677754d838b7bf7ad485a306a4237
SHA512 d41a83ba88149e931c99f11539e1787d2efb34a7908d8ea243c29e9fb344345852df46e4316a7842a63dc10894219f20561c213e1d7ced31b2f148d68527839b
SSDEEP 98304:w7kO9MPaTLbj5MhYv9PTEzb9HJTEs5S6QR/mSbyqb3:G84j5euYbnIs5G/m
TLSH
T15206336BA62926F3C0259134C0A9A60583EDBC3503645BDB77137F2E3F616C39DB9E42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom

File Explorer

2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom

.exe 3.6MB

2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom

IMPHASH f87d14076934fdec415d3b9b69abf877
SHA256 d9740220c7a6ecc00a8851aaf76bae458b353b7ab3fd8019406eed1d7286097b
MD5 b70387607e4f6a9be549f85658d1ad5b
SHA1 6ee83614da9677754d838b7bf7ad485a306a4237
SHA512 d41a83ba88149e931c99f11539e1787d2efb34a7908d8ea243c29e9fb344345852df46e4316a7842a63dc10894219f20561c213e1d7ced31b2f148d68527839b
SSDEEP 98304:w7kO9MPaTLbj5MhYv9PTEzb9HJTEs5S6QR/mSbyqb3:G84j5euYbnIs5G/m
TLSH
T15206336BA62926F3C0259134C0A9A60583EDBC3503645BDB77137F2E3F616C39DB9E42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Detects executables referencing combination of virtualization drivers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WriteFile GetTempPathA CloseHandle GetLastError SetEvent WaitForSingleObject CreateEventA OpenEventA Sleep GetCurrentProcess GetCurrentProcessId CreateProcessA OpenProcess GetTickCount GetSystemDirectoryA VirtualAlloc VirtualProtect VirtualFree ReadFile GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource WinExec lstrcpyA lstrcpyW lstrcatA lstrlenA FindResourceA MoveFileA MultiByteToWideChar CreateToolhelp32Snapshot Process32First Process32Next WriteConsoleW CreateFileW GetFileSize GetFileAttributesA DeleteFileA CreateFileA CreateDirectoryA GetEnvironmentVariableA GetModuleFileNameA GetCommandLineA SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent HeapAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW LoadLibraryExW LCMapStringW GetProcessHeap

user32

wsprintfA

advapi32

RegOpenKeyExA RegCloseKey GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken RegGetValueA

shlwapi

PathAppendA

ole32

IIDFromString CoInitializeEx CoGetObject CoUninitialize

Name

.text

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_b70387607e4f6a9be549f85658d1ad5b_cobalt-strike_icedid_satacom

kernel32

user32

advapi32

shlwapi

ole32

generic