2026-09-25_e514fe3c3daa482e278afd8f3b20b7bc_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-09-25_e514fe3c3daa482e278afd8f3b20b7bc_cobalt-strike_icedid_njrat_satacom_stealc
Size 207KB
Sample260925-wtc16sshre
SHA256 eba3cf305ba01e5e7e6f97dec5525c5eb0d0c22d5f2080f3d6267ff8c57be888
MD5 e514fe3c3daa482e278afd8f3b20b7bc
SHA1 d055a4c44e8143cadf435061972b1c5e0249d6cb
SHA512 23b817783e1820b7831988e14a318182baa70d7908c7af3fa6ac85d05aab69dffd79f7f129734322edf65847c0517a6e6629b6d75d595bc1e312bd10f517f4a3
SSDEEP 3072:MObMln9RkAfA797sYTAR/MuFp54AcvaqxZbBB2j2/Mvmtyb7ih8B+:MvfAdERF7cCg2aUvm4B+
TLSH
T117247E25F6A505FAE1778138C9424906EA737C464760AADF03A04BF69F237E09F3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_e514fe3c3daa482e278afd8f3b20b7bc_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-09-25_e514fe3c3daa482e278afd8f3b20b7bc_cobalt-strike_icedid_njrat_satacom_stealc

.exe 207KB

2026-09-25_e514fe3c3daa482e278afd8f3b20b7bc_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 24eeb0f8d1e6ca76165ed9d5ee46ba36
SHA256 eba3cf305ba01e5e7e6f97dec5525c5eb0d0c22d5f2080f3d6267ff8c57be888
MD5 e514fe3c3daa482e278afd8f3b20b7bc
SHA1 d055a4c44e8143cadf435061972b1c5e0249d6cb
SHA512 23b817783e1820b7831988e14a318182baa70d7908c7af3fa6ac85d05aab69dffd79f7f129734322edf65847c0517a6e6629b6d75d595bc1e312bd10f517f4a3
SSDEEP 3072:MObMln9RkAfA797sYTAR/MuFp54AcvaqxZbBB2j2/Mvmtyb7ih8B+:MvfAdERF7cCg2aUvm4B+
TLSH
T117247E25F6A505FAE1778138C9424906EA737C464760AADF03A04BF69F237E09F3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

36352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetStdHandle CreateFileA GetFileSize ReadFile CloseHandle GetLastError SetConsoleTextAttribute GetModuleHandleA GetProcAddress GetCurrentProcess GetCurrentThread LoadLibraryA WriteConsoleW CreateFileW HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcessHeap GetStringTypeW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WriteFile GetModuleFileNameW ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle

oleaut32

SafeArrayCreate SafeArrayDestroy SafeArrayAccessData VariantInit SafeArrayCreateVector SafeArrayPutElement SafeArrayUnaccessData

ole32

CoInitializeEx

mscoree

CLRCreateInstance

Name

.text

Size

131KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-25_e514fe3c3daa482e278afd8f3b20b7bc_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

oleaut32

ole32

mscoree

generic