2026-09-24_6365d871d184a02fc6fb089a004cf6cd_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-09-24_6365d871d184a02fc6fb089a004cf6cd_cobalt-strike_icedid_njrat_satacom_stealc
Size 422KB
Sample260925-keregacc36
SHA256 cfabc4c24879680307fb4986bd51c78400d1f3edba20d81295b495938cde8357
MD5 6365d871d184a02fc6fb089a004cf6cd
SHA1 f9dcd2c1da641acf3ea1e7ae0addda89b6eba859
SHA512 730ec4962734f8a075110e87351e8c9f2fa01d88f63222ab6a39aaa068b8f4c507de892d42bda9e57eabbcffd4693159eb86618083cad9cfad890bf47a1b2915
SSDEEP 12288:mpx/8wEVGiFneLHGPTjfJk762O0vzmEl:bV1QHGP/Jk9Fzz
TLSH
T1D794AE09EBA610FAF9AF857CC9924507EA727C1647A0EACF13904A572F336D09E3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_6365d871d184a02fc6fb089a004cf6cd_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-09-24_6365d871d184a02fc6fb089a004cf6cd_cobalt-strike_icedid_njrat_satacom_stealc

.exe 422KB

2026-09-24_6365d871d184a02fc6fb089a004cf6cd_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 55a0ef7fe53e47493c3adac8e26a15a7
SHA256 cfabc4c24879680307fb4986bd51c78400d1f3edba20d81295b495938cde8357
MD5 6365d871d184a02fc6fb089a004cf6cd
SHA1 f9dcd2c1da641acf3ea1e7ae0addda89b6eba859
SHA512 730ec4962734f8a075110e87351e8c9f2fa01d88f63222ab6a39aaa068b8f4c507de892d42bda9e57eabbcffd4693159eb86618083cad9cfad890bf47a1b2915
SSDEEP 12288:mpx/8wEVGiFneLHGPTjfJk762O0vzmEl:bV1QHGP/Jk9Fzz
TLSH
T1D794AE09EBA610FAF9AF857CC9924507EA727C1647A0EACF13904A572F336D09E3D711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

317952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetExitCodeThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameW CreateRemoteThread GetProcAddress SetConsoleTextAttribute SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteConsoleW GetCurrentProcess Sleep WaitForSingleObject GetLastError CloseHandle GetModuleHandleW GetStdHandle CreateFileW HeapSize LocalFree FormatMessageA GetLocaleInfoEx WideCharToMultiByte MultiByteToWideChar GetStringTypeW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent WriteFile ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree GetExitCodeProcess CreateProcessW GetFileType VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile HeapReAlloc GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap ReadConsoleW RtlUnwind

advapi32

FreeSid CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

shell32

ShellExecuteW

Name

.text

Size

189KB

Virtual Size

189KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

134KB

Virtual Size

326KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_6365d871d184a02fc6fb089a004cf6cd_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

advapi32

shell32

generic