2026-09-23_7ff2a7112cc2d3ba7001236edc7893aa_cobalt-strike_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_7ff2a7112cc2d3ba7001236edc7893aa_cobalt-strike_icedid_njrat_satacom
Size 1.9MB
Sample260924-gp2reafd67
SHA256 a63213aa462c97ec03bd4ec76d7dc56bd9d6c10ff2be604954fd029789d4ccaa
MD5 7ff2a7112cc2d3ba7001236edc7893aa
SHA1 a25432687d7ecffef30374ca9152a2022e9b68f4
SHA512 f6fe6642efd97be00bdd61c9db6038c40e67cce56bdd0ed6769ac9be6300130ddb6698837847e9ddd316453d5d1f7799a234eb10cc36ef10b2bbe7cc3a0e46d0
SSDEEP 49152:ruPFm5L0w2V1u0N35m/tAYBFcPEriq4bG4+:AFm12V40doZFcPEGXt+
TLSH
T1BB956D17E2E160EDD067C275C7175222B63A7C040734FEEF52A4DB353E62EA12A2E764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_7ff2a7112cc2d3ba7001236edc7893aa_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-09-23_7ff2a7112cc2d3ba7001236edc7893aa_cobalt-strike_icedid_njrat_satacom

.exe 1.9MB

2026-09-23_7ff2a7112cc2d3ba7001236edc7893aa_cobalt-strike_icedid_njrat_satacom

IMPHASH a37658038d3b23a5191fa7c1d7f573be
SHA256 a63213aa462c97ec03bd4ec76d7dc56bd9d6c10ff2be604954fd029789d4ccaa
MD5 7ff2a7112cc2d3ba7001236edc7893aa
SHA1 a25432687d7ecffef30374ca9152a2022e9b68f4
SHA512 f6fe6642efd97be00bdd61c9db6038c40e67cce56bdd0ed6769ac9be6300130ddb6698837847e9ddd316453d5d1f7799a234eb10cc36ef10b2bbe7cc3a0e46d0
SSDEEP 49152:ruPFm5L0w2V1u0N35m/tAYBFcPEriq4bG4+:AFm12V40doZFcPEGXt+
TLSH
T1BB956D17E2E160EDD067C275C7175222B63A7C040734FEEF52A4DB353E62EA12A2E764
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

GetUserNameA RegOpenKeyExA RegSetValueExA RegCloseKey RegDeleteValueA RegQueryValueExA RegQueryInfoKeyA RegEnumKeyExA RevertToSelf

ole32

CLSIDFromString CoCreateInstance OleInitialize CoSetProxyBlanket OleUninitialize CoInitializeSecurity CoCreateGuid CoUninitialize CoInitializeEx

oleaut32

SysFreeString SysAllocString VariantInit SysStringByteLen VariantClear SysAllocStringByteLen

shell32

ShellExecuteA SHGetFolderPathA SHGetDesktopFolder CommandLineToArgvW

gdi32

CreateFontA DeleteObject CreateFontIndirectA DeleteDC StretchBlt SetStretchBltMode BitBlt SelectObject CreateDIBSection CreateCompatibleDC SetTextColor SetBkColor GetStockObject GetDeviceCaps CreateSolidBrush

gdiplus

GdipCreateBitmapFromHBITMAP GdipSaveImageToFile GdiplusShutdown GdipDisposeImage GdipLoadImageFromFile GdiplusStartup

user32

GetMessageA SetForegroundWindow UpdateWindow RegisterClassA DefWindowProcA UnregisterClassA DestroyWindow DestroyIcon FillRect GetDesktopWindow ReleaseDC GetDC GetKeyboardLayout LoadStringA GetSysColor DispatchMessageA PostQuitMessage PeekMessageA SendMessageA EnableWindow GetClientRect CreateWindowExA SetCursor GetDialogBaseUnits RegisterClassExA LoadIconA LoadCursorA GetClassInfoExA FindWindowA SystemParametersInfoA wsprintfA CharNextA GetSystemMetrics ShowWindow SetWindowTextA SetTimer KillTimer LockWorkStation ExitWindowsEx SendInput OpenClipboard MessageBoxA IsClipboardFormatAvailable GetClipboardData CloseClipboard TranslateMessage

comctl32

InitCommonControlsEx ImageList_Destroy ImageList_GetImageCount ImageList_Create ord17

iphlpapi

GetAdaptersInfo

kernel32

LCMapStringW GetTimeZoneInformation GetConsoleOutputCP GetConsoleMode SetFilePointerEx FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect UnhandledExceptionFilter GetEnvironmentStringsW RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetStdHandle FreeLibraryAndExitThread ExitThread GetModuleHandleExW RtlPcToFileHeader RaiseException EncodePointer RtlLookupFunctionEntry InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead FlushViewOfFile OutputDebugStringW OutputDebugStringA WaitForSingleObjectEx UnlockFileEx UnlockFile SystemTimeToFileTime SetEndOfFile LockFileEx LockFile HeapCompact HeapValidate HeapSize HeapReAlloc HeapDestroy HeapCreate GetSystemTimeAsFileTime GetSystemTime GetFullPathNameW GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW ReadConsoleW WriteConsoleW IsDebuggerPresent AllocConsole GetConsoleWindow CreateThread WaitForSingleObject CloseHandle MultiByteToWideChar GetProcessHeap HeapAlloc HeapFree GetComputerNameA GetFileAttributesA Sleep GetCurrentProcessId GetTickCount CreateFileA GetFileSize ReadFile FindFirstFileA FindNextFileA FindClose GetTempPathA RemoveDirectoryA CreateDirectoryA WaitForMultipleObjects DeleteFileA SetFileAttributesA GetTickCount64 InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetModuleFileNameA GetLastError CopyFileA GetFileSizeEx CreateProcessA TerminateProcess GetExitCodeProcess GetCurrentProcess GetSystemPowerStatus GetModuleHandleA GetProcAddress WideCharToMultiByte GlobalMemoryStatusEx GetFileAttributesExA GetCurrentThreadId WriteFile GetEnvironmentVariableA SetEnvironmentVariableA GetSystemFirmwareTable GetSystemInfo GetDiskFreeSpaceExA SetErrorMode GetStartupInfoA GetModuleFileNameW GetCommandLineA lstrlenA GetCommandLineW lstrlenW LocalFree CreateFileMappingA MapViewOfFile UnmapViewOfFile CreateMutexA GetTempPathW GetWindowsDirectoryA GetSystemDirectoryA GetSystemWindowsDirectoryA GetTempFileNameA lstrcpynA lstrcatA LoadLibraryA FreeLibrary MulDiv FindResourceA SizeofResource LoadResource LockResource EnumResourceNamesA GlobalAlloc GlobalFree ExpandEnvironmentStringsA GetFullPathNameA GetDiskFreeSpaceA GetVolumeInformationA GetNativeSystemInfo IsWow64Process GetLocaleInfoA GetUserDefaultUILanguage GetSystemDefaultLangID GetUserDefaultLCID GetSystemDefaultLCID GetACP GetThreadLocale lstrcpynW lstrcatW DeleteFileW QueryPerformanceCounter CreatePipe SetHandleInformation PeekNamedPipe ExitProcess FlushFileBuffers Process32First QueryFullProcessImageNameA Process32Next ResumeThread Module32First Module32Next GetExitCodeThread GetEnvironmentStrings FreeEnvironmentStringsA GetVolumePathNameA CopyFileExA DuplicateHandle GetFileType GetFinalPathNameByHandleA SetFilePointer QueryDosDeviceA GlobalLock GlobalUnlock MoveFileExA DeleteCriticalSection TryEnterCriticalSection AreFileApisANSI CreateFileW CreateFileMappingW CreateMutexW FormatMessageA FormatMessageW RtlUnwind

Name

.c4B43A

Size

163KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

llvmmsvc

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.r4B43A

Size

557KB

Virtual Size

557KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dFD24A

Size

19KB

Virtual Size

335KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.kF28A7

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.j57FD2

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_7ff2a7112cc2d3ba7001236edc7893aa_cobalt-strike_icedid_njrat_satacom

advapi32

ole32

oleaut32

shell32

gdi32

gdiplus

user32

comctl32

iphlpapi

kernel32

generic