2026-09-25_f98517e2b21691e642a38fd57bac3cee_cobalt-strike_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-25_f98517e2b21691e642a38fd57bac3cee_cobalt-strike_icedid_njrat_satacom
Size 167KB
Sample260925-vg2nbsfh39
SHA256 d28bfb42d08422d67247bf60c250d37d05f75791be1692e941e1dc558a371d5c
MD5 f98517e2b21691e642a38fd57bac3cee
SHA1 27ba638914d8b5825e947b0c66ae1436a6596002
SHA512 9ddb5a04751601c857b28ef79d29df07c94ec6f3509ad7240d30e03102b81e8032128926b3bd8243690f621ac224178c36ac500747a32b90db379165d88d57ab
SSDEEP 3072:WnXP7jhfxuTWzrZrSI1LPnmpF51qCC608fQwwkzjEva:WX/eTWPZGQmV1Phjc
TLSH
T1DEF33A5677F520F9F17396388EA14502E7B778325B20DAEF0350067A6F236E19D39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_f98517e2b21691e642a38fd57bac3cee_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-09-25_f98517e2b21691e642a38fd57bac3cee_cobalt-strike_icedid_njrat_satacom

.exe 167KB

2026-09-25_f98517e2b21691e642a38fd57bac3cee_cobalt-strike_icedid_njrat_satacom

IMPHASH 69f46a39c72a557869cabc5e387f803a
SHA256 d28bfb42d08422d67247bf60c250d37d05f75791be1692e941e1dc558a371d5c
MD5 f98517e2b21691e642a38fd57bac3cee
SHA1 27ba638914d8b5825e947b0c66ae1436a6596002
SHA512 9ddb5a04751601c857b28ef79d29df07c94ec6f3509ad7240d30e03102b81e8032128926b3bd8243690f621ac224178c36ac500747a32b90db379165d88d57ab
SSDEEP 3072:WnXP7jhfxuTWzrZrSI1LPnmpF51qCC608fQwwkzjEva:WX/eTWPZGQmV1Phjc
TLSH
T1DEF33A5677F520F9F17396388EA14502E7B778325B20DAEF0350067A6F236E19D39B22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ReadFile WriteProcessMemory HeapFree SetLastError SetDefaultDllDirectories GetCurrentProcess WriteFile GetModuleHandleExW GetPrivateProfileIntW TerminateProcess GetModuleFileNameW WaitForMultipleObjects InitializeProcThreadAttributeList CreatePipe InitializeCriticalSectionEx WaitForSingleObject CreateFileW ResumeThread OpenProcess HeapSize SetProcessMitigationPolicy CreateToolhelp32Snapshot CreateEventW GetPrivateProfileStringW Sleep FormatMessageW GetLastError UpdateProcThreadAttribute Process32NextW SetEvent DeleteFileW Process32FirstW HeapReAlloc CloseHandle GetNativeSystemInfo CreateThread DeleteProcThreadAttributeList HeapAlloc VirtualProtectEx GetThreadContext WriteConsoleW GetProcAddress LocalFree DeleteCriticalSection GetCurrentProcessId GetProcessHeap CreateProcessW GetModuleHandleW FreeLibrary FlushInstructionCache WideCharToMultiByte VirtualFreeEx SetThreadContext GetPrivateProfileStringA LoadLibraryExW GetConsoleMode RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent ExitProcess GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetStringTypeW SetFilePointerEx FlushFileBuffers GetConsoleOutputCP

api-ms-win-core-memory-l1-1-6

VirtualAlloc2

Name

.text

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_f98517e2b21691e642a38fd57bac3cee_cobalt-strike_icedid_njrat_satacom

kernel32

api-ms-win-core-memory-l1-1-6

generic