2026-09-24_4b9b8ff55564b998f7a1f54d8e332741_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_4b9b8ff55564b998f7a1f54d8e332741_cobalt-strike_icedid_njrat_satacom_stealc
Size 843KB
Sample260925-mkyrvadd77
SHA256 3be134233256b78e9296b9268e79095099ea384d47f6c356590a877c9fa7a41d
MD5 4b9b8ff55564b998f7a1f54d8e332741
SHA1 82c7d1be00bb015a084cfa6ffb2ceca6eef01a2c
SHA512 cbeac96b3520e550eee13868ce86589aed85f995ce187e60241cfb3fef3ff633780d205ca977d513c905603039f98909ca721a97cfbb295aab45986522249c71
SSDEEP 12288:ifQP72WQP0+EfHJZ4F3qA/JOXNlV99I85tyOV0VCp6L:zSd0+ED4F3qeJOXL9I85xp0L
TLSH
T170058D25BBA901EDD1B7C1B9C9664902FAB2BC0647319ACF1390565A2F3BAD41F3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-24_4b9b8ff55564b998f7a1f54d8e332741_cobalt-strike_icedid_njrat_satacom_stealc

.exe 843KB

2026-09-24_4b9b8ff55564b998f7a1f54d8e332741_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH ae5877a3a770f4b11ecd4c1a9a4bf89b
SHA256 3be134233256b78e9296b9268e79095099ea384d47f6c356590a877c9fa7a41d
MD5 4b9b8ff55564b998f7a1f54d8e332741
SHA1 82c7d1be00bb015a084cfa6ffb2ceca6eef01a2c
SHA512 cbeac96b3520e550eee13868ce86589aed85f995ce187e60241cfb3fef3ff633780d205ca977d513c905603039f98909ca721a97cfbb295aab45986522249c71
SSDEEP 12288:ifQP72WQP0+EfHJZ4F3qA/JOXNlV99I85tyOV0VCp6L:zSd0+ED4F3qeJOXL9I85xp0L
TLSH
T170058D25BBA901EDD1B7C1B9C9664902FAB2BC0647319ACF1390565A2F3BAD41F3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

5f:d3:01:fa:70:0d:f9:3f:c0:d1:b7:60:6b:6f:93:7e:fd:77:4f:d1:96:05:c4:56:7e:b7:4e:86:fc:dc:9f:d6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 21, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1c:fa:cd:c5:9b:e8:2f:7e:c4:00:00:00:00:02:1c

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

323392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\a\_work\1\s\x64\Release\LightSwitchService\PowerToys.LightSwitchService.pdb

advapi32

RegQueryValueExW StartServiceCtrlDispatcherW RegOpenKeyExW RegisterServiceCtrlHandlerW SetServiceStatus RegCloseKey RegNotifyChangeKeyValue EventUnregister RegGetValueW EventSetInformation EventRegister EventWriteTransfer RegSetValueExW

kernel32

HeapFree SetLastError GetCommandLineW ReleaseSemaphore GetModuleHandleExW WaitForMultipleObjects WaitForSingleObject GetCurrentThreadId OpenEventW ReleaseMutex OpenProcess CreateEventW FormatMessageW GetLastError OutputDebugStringW SetEvent WaitForSingleObjectEx OpenSemaphoreW CloseHandle CreateThread ResetEvent HeapAlloc GetLocalTime GetModuleFileNameA CreateMutexExW LocalFree GetCurrentProcessId GetProcessHeap GetModuleHandleW WideCharToMultiByte DebugBreak IsDebuggerPresent GetTimeZoneInformation RtlUnwind SetEndOfFile HeapSize FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW ReadFile FlushFileBuffers GetConsoleOutputCP SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW CreateSemaphoreExW GetProcAddress SetEnvironmentVariableW OutputDebugStringA CloseThreadpoolIo AcquireSRWLockExclusive TryAcquireSRWLockShared CreateFileW CancelIoEx GetOverlappedResult WaitForThreadpoolIoCallbacks StartThreadpoolIo ReadDirectoryChangesW CancelThreadpoolIo GetFileTime CreateThreadpoolIo ReleaseSRWLockShared ReleaseSRWLockExclusive FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetFileInformationByHandleEx GetExitCodeThread WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime WakeConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList FlsAlloc FlsGetValue FlsSetValue FlsFree ExitThread FreeLibrary FreeLibraryAndExitThread RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent SetStdHandle GetFileType DeleteFileW ExitProcess GetModuleFileNameW VirtualProtect

user32

MessageBoxW SendMessageTimeoutW

shell32

CommandLineToArgvW SHGetKnownFolderPath

api-ms-win-core-console-l1-1-0

WriteConsoleA GetConsoleMode WriteConsoleW

api-ms-win-core-file-l1-1-0

WriteFile GetFileAttributesW

api-ms-win-core-synch-l1-2-0

WaitOnAddress Sleep WakeByAddressAll

api-ms-win-core-timezone-l1-1-0

GetDynamicTimeZoneInformation

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo SetConsoleTextAttribute

ole32

CoTaskMemFree

oleaut32

SetErrorInfo GetErrorInfo SysStringLen SysFreeString

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

528KB

Virtual Size

528KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

162KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_4b9b8ff55564b998f7a1f54d8e332741_cobalt-strike_icedid_njrat_satacom_stealc

advapi32

kernel32

user32

shell32

api-ms-win-core-console-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l2-1-0

ole32

oleaut32

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic