2026-09-23_2dc350fb5f1b026039fe511da51d24d8_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-09-23_2dc350fb5f1b026039fe511da51d24d8_cobalt-strike_icedid_njrat_satacom_stealc
Size 442KB
Sample260924-ns2ddacg56
SHA256 d93ae83aa106445b6ff184779512f51fcc92a3d7675c433a4946d3c705bec1e2
MD5 2dc350fb5f1b026039fe511da51d24d8
SHA1 9d1a8d38bb9aa8fd491ee30fa8916db8e6c579c2
SHA512 a270b8aa816d3c2135da2c33cc728d871e8f90a2f8c8d0857f0ea8a93fac7bba8b9dca2e945357fbc5d4fb7fd49fbb5f51d8eed970a42fa0dddf946c8d1deb50
SSDEEP 12288:6E3R4rAra5yqSsNdHRC0R8xkcjCnBmYY3m8xY498:gex3yBjY2WBS
TLSH
T1FCA45C25A69800F9E277D2BCCA534903E77278464731EADF03A4EA721E176D49E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_2dc350fb5f1b026039fe511da51d24d8_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-09-23_2dc350fb5f1b026039fe511da51d24d8_cobalt-strike_icedid_njrat_satacom_stealc

.exe 442KB

2026-09-23_2dc350fb5f1b026039fe511da51d24d8_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH c30080ee15d1edc3748851f863836b26
SHA256 d93ae83aa106445b6ff184779512f51fcc92a3d7675c433a4946d3c705bec1e2
MD5 2dc350fb5f1b026039fe511da51d24d8
SHA1 9d1a8d38bb9aa8fd491ee30fa8916db8e6c579c2
SHA512 a270b8aa816d3c2135da2c33cc728d871e8f90a2f8c8d0857f0ea8a93fac7bba8b9dca2e945357fbc5d4fb7fd49fbb5f51d8eed970a42fa0dddf946c8d1deb50
SSDEEP 12288:6E3R4rAra5yqSsNdHRC0R8xkcjCnBmYY3m8xY498:gex3yBjY2WBS
TLSH
T1FCA45C25A69800F9E277D2BCCA534903E77278464731EADF03A4EA721E176D49E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

172288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\build\token.pdb

winhttp

WinHttpOpen WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpCrackUrl

user32

MessageBoxW

kernel32

EncodePointer SetEndOfFile WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP GetEnvironmentVariableW CloseHandle CreateProcessW GetTickCount64 GetModuleFileNameW GetProcAddress LoadLibraryA MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency LocalFree FormatMessageA GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete GetLastError WaitForSingleObjectEx Sleep GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 GetModuleHandleW CopyFile2 GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WakeAllConditionVariable RtlUnwind DecodePointer CompareStringEx GetCPInfo LCMapStringEx GetStringTypeW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW IsValidCodePage RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetStdHandle WriteFile GetCurrentProcess ExitProcess TerminateProcess HeapFree HeapReAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation

Name

.text

Size

321KB

Virtual Size

320KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_2dc350fb5f1b026039fe511da51d24d8_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

user32

kernel32

generic