2026-09-25_98c6920ce00f34239e09c90e5490497c_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-09-25_98c6920ce00f34239e09c90e5490497c_cobalt-strike_icedid_njrat_satacom_stealc
Size 256KB
Sample260925-2by4ksaa38
SHA256 9811a1abf1462c8ef7be4958d5138201f30850099118f3160b72095991895f00
MD5 98c6920ce00f34239e09c90e5490497c
SHA1 1b6210dfcbb937357d21a4e82c6e7c3b830c6f05
SHA512 a0c8521940619bd675f6426cf1a40f2804d6053a24411c851bf62d06b0185cb36751d48b34267ab4465c790895f0791b58a2063170717d4081cdcf85efd7b294
SSDEEP 3072:3LYcv1jZcHy7eDhYhWypn2M00QBIRjKlmodejGKCtmclfR7BD43oVwQddnVGKybH:3LYulZcSGhYe7IR+m7jef43o+WTW
TLSH
T1CD446C02B6650DF6ED67843DC993950AEA727C510760EAEF03B08A971F236D0AE3F751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_98c6920ce00f34239e09c90e5490497c_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-09-25_98c6920ce00f34239e09c90e5490497c_cobalt-strike_icedid_njrat_satacom_stealc

.exe 256KB

2026-09-25_98c6920ce00f34239e09c90e5490497c_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH f5bcc810c1e79d05d7f5eb1529d4116b
SHA256 9811a1abf1462c8ef7be4958d5138201f30850099118f3160b72095991895f00
MD5 98c6920ce00f34239e09c90e5490497c
SHA1 1b6210dfcbb937357d21a4e82c6e7c3b830c6f05
SHA512 a0c8521940619bd675f6426cf1a40f2804d6053a24411c851bf62d06b0185cb36751d48b34267ab4465c790895f0791b58a2063170717d4081cdcf85efd7b294
SSDEEP 3072:3LYcv1jZcHy7eDhYhWypn2M00QBIRjKlmodejGKCtmclfR7BD43oVwQddnVGKybH:3LYulZcSGhYe7IR+m7jef43o+WTW
TLSH
T1CD446C02B6650DF6ED67843DC993950AEA727C510760EAEF03B08A971F236D0AE3F751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

64080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage SetProcessDPIAware GetMonitorInfoW MonitorFromRect SystemParametersInfoW LoadCursorA GetWindow GetWindowThreadProcessId EnumWindows PtInRect EqualRect FillRect ScreenToClient ClientToScreen GetCursorPos GetWindowRect GetClientRect InvalidateRect EndPaint BeginPaint GetForegroundWindow UpdateWindow DrawTextA MsgWaitForMultipleObjectsEx SendInput GetAsyncKeyState IsIconic IsWindowVisible SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW TrackMouseEvent

gdi32

TextOutA MoveToEx SetTextColor SetBkMode SelectObject SaveDC RoundRect RestoreDC Rectangle LineTo GetTextExtentPoint32A GetStockObject Ellipse DeleteObject DeleteDC CreateSolidBrush CreatePen CreateFontW CreateFontA CreateCompatibleDC CreateCompatibleBitmap BitBlt

kernel32

GetACP IsValidCodePage SetFilePointerEx GetOEMCP LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize CreateFileW WriteConsoleW CloseHandle SetEvent WaitForSingleObject CreateEventW SetWaitableTimer CreateWaitableTimerExW WaitForMultipleObjects CreateWaitableTimerW GetProcessTimes GetExitCodeProcess OpenProcess GetNativeSystemInfo ReadProcessMemory GetModuleHandleW GetProcAddress CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW QueryPerformanceCounter QueryPerformanceFrequency GetLastError WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess GetModuleFileNameW GetStdHandle WriteFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree CreateProcessW GetFileAttributesExW HeapAlloc

Name

.text

Size

161KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_98c6920ce00f34239e09c90e5490497c_cobalt-strike_icedid_njrat_satacom_stealc

user32

gdi32

kernel32

generic