2026-09-23_5f9ae4bf524a9f1300f718bd488aab8b_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_5f9ae4bf524a9f1300f718bd488aab8b_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.4MB
Sample260924-jp8aas1bpb
SHA256 f853d1a8a712a3c5677306ab8ec27f05994532dc405498a1b48b3e6e0a7c7c0a
MD5 5f9ae4bf524a9f1300f718bd488aab8b
SHA1 dcd1e511f405a495162122f00e396346db6e31c7
SHA512 22623725c1f5c8c711818c0b8d7b02828026487223694a1dfcd5095c7fd3e8dcc5e5751310cc8893f473d69c23f828835d3ec701e0208c10bd08b4daca12a2d1
SSDEEP 24576:l50+LU5232u8xFOY5ZDjXZQUDG5g1ACE6Nn+BG:l5a5tPxFOY/jXZZC5gBfN
TLSH
T142659E0BA2B540FCD06BD179CA075A07FBB2740517349ADB5690CA662F23FE11FBA325
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_5f9ae4bf524a9f1300f718bd488aab8b_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-09-23_5f9ae4bf524a9f1300f718bd488aab8b_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.4MB

2026-09-23_5f9ae4bf524a9f1300f718bd488aab8b_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 2bf30bde4f493dcb4d6ab916a4b8636f
SHA256 f853d1a8a712a3c5677306ab8ec27f05994532dc405498a1b48b3e6e0a7c7c0a
MD5 5f9ae4bf524a9f1300f718bd488aab8b
SHA1 dcd1e511f405a495162122f00e396346db6e31c7
SHA512 22623725c1f5c8c711818c0b8d7b02828026487223694a1dfcd5095c7fd3e8dcc5e5751310cc8893f473d69c23f828835d3ec701e0208c10bd08b4daca12a2d1
SSDEEP 24576:l50+LU5232u8xFOY5ZDjXZQUDG5g1ACE6Nn+BG:l5a5tPxFOY/jXZZC5gBfN
TLSH
T142659E0BA2B540FCD06BD179CA075A07FBB2740517349ADB5690CA662F23FE11FBA325
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1008880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CryptStringToBinaryA CryptUnprotectData

bcrypt

BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptDecrypt

winhttp

WinHttpSendRequest WinHttpCloseHandle WinHttpReceiveResponse WinHttpOpen WinHttpOpenRequest WinHttpConnect

kernel32

WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW Sleep LocalFree GetCurrentProcessId GetConsoleWindow GetComputerNameA AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LockFileEx GetFileSize DeleteCriticalSection GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers CompareStringW GetUserDefaultLCID IsValidLocale GetLocaleInfoW RtlUnwind GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW SetFileInformationByHandle CreateFile2 GetModuleHandleW GetFileInformationByHandleEx InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetStdHandle GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType GetConsoleOutputCP GetConsoleMode VirtualProtect LoadLibraryExW LCMapStringW

user32

ShowWindow

advapi32

GetUserNameA

shell32

SHGetFolderPathW

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

194KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_5f9ae4bf524a9f1300f718bd488aab8b_cobalt-strike_icedid_njrat_satacom_stealc

crypt32

bcrypt

winhttp

kernel32

user32

advapi32

shell32

generic