2026-09-26_5a570da62053f676ca21eb7b662ade2c_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-26_5a570da62053f676ca21eb7b662ade2c_cobalt-strike_icedid_njrat_satacom_stealc
Size 3.6MB
Sample260926-1713dagh22
SHA256 fab5714bca3ef543b3b23e6559cab855db45deaf70c1be7cd8034d5a21b27189
MD5 5a570da62053f676ca21eb7b662ade2c
SHA1 3fe7a5824b8cf9739243bb35c164fd65ee8ee7d9
SHA512 7e639911523f3ac5a9161eec0e16dd620ee4d3ddf77e123e0ab1440937988aaf8a1154110613dbf06f82a621cdc9a30e61da543ee1eadf54f74b39af07966b9b
SSDEEP 49152://4hvuUDtiKq6rKAbldKPs0ISGPzUVa718akILxB93h3OPZ63nFqrI7NKsKH:/Q7QffcUVapCILxB93NOI37NKsKH
TLSH
T15F06E192B2A504F8D46FD1348A976007E93738990372A5DF73DD45691F73BE08ABAF02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-26_5a570da62053f676ca21eb7b662ade2c_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-09-26_5a570da62053f676ca21eb7b662ade2c_cobalt-strike_icedid_njrat_satacom_stealc

.exe 3.6MB

2026-09-26_5a570da62053f676ca21eb7b662ade2c_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 348081711cb0112f834e77d737383f06
SHA256 fab5714bca3ef543b3b23e6559cab855db45deaf70c1be7cd8034d5a21b27189
MD5 5a570da62053f676ca21eb7b662ade2c
SHA1 3fe7a5824b8cf9739243bb35c164fd65ee8ee7d9
SHA512 7e639911523f3ac5a9161eec0e16dd620ee4d3ddf77e123e0ab1440937988aaf8a1154110613dbf06f82a621cdc9a30e61da543ee1eadf54f74b39af07966b9b
SSDEEP 49152://4hvuUDtiKq6rKAbldKPs0ISGPzUVa718akILxB93h3OPZ63nFqrI7NKsKH:/Q7QffcUVapCILxB93NOI37NKsKH
TLSH
T15F06E192B2A504F8D46FD1348A976007E93738990372A5DF73DD45691F73BE08ABAF02
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1062336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess GetStdHandle RtlCaptureStackBackTrace GetTickCount64 GetVersionExA K32GetModuleInformation AddVectoredExceptionHandler K32EnumProcessModules SetUnhandledExceptionFilter CreateToolhelp32Snapshot Sleep Process32NextW Process32FirstW CloseHandle ReadProcessMemory GetExitCodeProcess WriteProcessMemory GetTickCount SetPriorityClass SetThreadPriority WaitForSingleObject GetCurrentThread CreateThread SetLastError GetSystemInfo Module32FirstW VirtualProtectEx VirtualAllocEx GetModuleHandleW FlushInstructionCache Module32NextW VirtualFreeEx VirtualQueryEx GetProcessId CompareStringOrdinal OpenProcess GetLastError SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetLocaleInfoA GetProcessHeap SetEnvironmentVariableW GetConsoleScreenBufferInfo GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc CreateProcessW GetTimeZoneInformation GetFileSizeEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect HeapFree HeapAlloc GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetCommandLineW GetCommandLineA WriteFile GetModuleFileNameW TerminateProcess ExitProcess GetModuleHandleExW GetModuleFileNameA QueryPerformanceCounter FreeLibrary GetModuleHandleA GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc MultiByteToWideChar FreeLibraryAndExitThread GetProcAddress IsDBCSLeadByte QueryPerformanceFrequency FreeEnvironmentStringsW LoadLibraryA OutputDebugStringA ExitThread ReadFile FlsFree FlsSetValue FlsGetValue RtlUnwind FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetSystemTimePreciseAsFileTime FormatMessageA WaitForSingleObjectEx GetExitCodeThread LocalFree GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW

user32

GetClientRect IsWindowUnicode SetClipboardData ReleaseCapture EmptyClipboard CloseClipboard OpenClipboard GetCursorPos GetClipboardData GetSystemMetrics SetCursor DestroyWindow CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW SetWindowDisplayAffinity SetLayeredWindowAttributes TranslateMessage SetWindowLongW PostQuitMessage UpdateWindow BeginPaint EndPaint IsWindow SetCapture SendInput GetAsyncKeyState FindWindowW MessageBoxA DefWindowProcW GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCursorPos

advapi32

FreeSid LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken AllocateAndInitializeSid CheckTokenMembership

shell32

ShellExecuteW

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea DwmFlush

dbghelp

SymFromAddr SymInitialize

winmm

timeBeginPeriod timeEndPeriod

d3d11

D3D11CreateDeviceAndSwapChain

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

699KB

Virtual Size

721KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-26_5a570da62053f676ca21eb7b662ade2c_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

imm32

d3dcompiler_47

dwmapi

dbghelp

winmm

d3d11

generic