2026-09-28_def1dbd1f7d6f2dd0e9f4b812928ad5a_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_def1dbd1f7d6f2dd0e9f4b812928ad5a_cobalt-strike_icedid_njrat_satacom_stealc
Size 23.0MB
Sample260928-3eed1swbme
SHA256 4b4eb92edae52165abe23bb24fd349437b39d993d66961f06b6e3a6830c97127
MD5 def1dbd1f7d6f2dd0e9f4b812928ad5a
SHA1 cde8928f3b250eecf006d717ca256c083d0fb13e
SHA512 142406e173c762244f665c343d470c896358057cb3161e5c6e94b51aac731f8b5171fddc58af8f5cf8d80bdd0ffa2b140c9b4453f680b3d0d342927449c1222b
SSDEEP 393216:gpj0LZ3qm6QKvowbHM/1DlG1UTGyyBYhMkWdhmRMO43pLgJTKeueCvKXIjQKR6Yw:20LZ3qm4r3pHeu+sYj1lGEHaES
TLSH
T163371296E5E50CE4D421B234C4759D23D23B780603709EEF277C956ECEBB6E0A9B3612
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_def1dbd1f7d6f2dd0e9f4b812928ad5a_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-09-28_def1dbd1f7d6f2dd0e9f4b812928ad5a_cobalt-strike_icedid_njrat_satacom_stealc

.exe 23.0MB

2026-09-28_def1dbd1f7d6f2dd0e9f4b812928ad5a_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 672c0e2d46021e9496f78d906fc80922
SHA256 4b4eb92edae52165abe23bb24fd349437b39d993d66961f06b6e3a6830c97127
MD5 def1dbd1f7d6f2dd0e9f4b812928ad5a
SHA1 cde8928f3b250eecf006d717ca256c083d0fb13e
SHA512 142406e173c762244f665c343d470c896358057cb3161e5c6e94b51aac731f8b5171fddc58af8f5cf8d80bdd0ffa2b140c9b4453f680b3d0d342927449c1222b
SSDEEP 393216:gpj0LZ3qm6QKvowbHM/1DlG1UTGyyBYhMkWdhmRMO43pLgJTKeueCvKXIjQKR6Yw:20LZ3qm4r3pHeu+sYj1lGEHaES
TLSH
T163371296E5E50CE4D421B234C4759D23D23B780603709EEF277C956ECEBB6E0A9B3612
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1637744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Jordin\Desktop\RsExternal\Release\Kymera.pdb

d3d11

D3D11CreateDeviceAndSwapChain D3D11CreateDevice

d3dcompiler_47

D3DCompile

dxgi

CreateDXGIFactory1

dwmapi

DwmSetWindowAttribute

ole32

CoTaskMemFree

kernel32

GetCurrentProcess TerminateProcess GetExitCodeProcess ProcessIdToSessionId GetProcessId OpenProcess VirtualQueryEx GetModuleFileNameW LocalFree QueryFullProcessImageNameW GetNamedPipeClientProcessId GetNamedPipeServerProcessId GetFileInformationByHandleEx K32EnumProcessModulesEx K32GetModuleInformation SetProcessMitigationPolicy GetEnvironmentVariableW SetEnvironmentVariableW GetFileAttributesW GetFileSizeEx ResumeThread CreateProcessW GetThreadContext SetThreadContext GetSystemDirectoryW VirtualProtect VirtualAllocEx ReadProcessMemory WriteProcessMemory GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW ExpandEnvironmentStringsW MultiByteToWideChar CreateToolhelp32Snapshot Process32FirstW Process32NextW WideCharToMultiByte GetWindowsDirectoryW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW SetPriorityClass MoveFileExW GetComputerNameA GetSystemTimeAsFileTime GetModuleFileNameA GetModuleHandleA FindResourceA GetCurrentThreadId lstrcmpA OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree VerSetConditionMask FreeLibrary LoadLibraryA GetLocaleInfoA IsDBCSLeadByte OutputDebugStringW UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind GetProcessTimes HeapAlloc HeapFree ExitProcess IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread WriteConsoleW GetModuleHandleExW GetFileType GetStdHandle FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection CreateFile2 GetFileAttributesExW FindFirstFileExW GetLocaleInfoEx WakeAllConditionVariable GetExitCodeThread SwitchToThread WaitForSingleObjectEx FormatMessageA SleepConditionVariableSRW AcquireSRWLockShared ReleaseSRWLockShared TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive WaitForMultipleObjects CreateEventW WaitForSingleObject GetTimeZoneInformation CancelIoEx GetOverlappedResult WaitNamedPipeW CreateNamedPipeW DisconnectNamedPipe ConnectNamedPipe SetHandleInformation DuplicateHandle CloseHandle WriteFile ReadFile GetFinalPathNameByHandleW FlushFileBuffers CreateFileW GetCommandLineW GetTickCount64 GetSystemInfo GetCurrentProcessId Sleep QueryPerformanceFrequency QueryPerformanceCounter SetLastError GetLastError HeapReAlloc IsValidCodePage GetACP GetOEMCP LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize SetEndOfFile RtlCaptureContext RtlUnwind GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW

user32

GetCursorPos SetCursorPos IsWindowUnicode SetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard GetAncestor MonitorFromWindow LoadCursorA GetClassNameA EnumWindows SetWindowLongPtrA GetWindowLongPtrA ClipCursor ClientToScreen GetClipCursor SetCursor ShowCursor GetClientRect SetActiveWindow GetSystemMetrics ReleaseCapture GetCapture GetFocus SetFocus BringWindowToTop SetWindowDisplayAffinity GetWindowDisplayAffinity SetProcessDPIAware SetLayeredWindowAttributes CreateWindowExA RegisterClassExA DefWindowProcA AttachThreadInput MapVirtualKeyW GetKeyNameTextW MessageBoxW GetForegroundWindow PeekMessageA DispatchMessageA SystemParametersInfoW GetIconInfo DrawIconEx DestroyIcon LoadCursorW ScreenToClient SetWindowRgn ReleaseDC GetDC UpdateWindow MsgWaitForMultipleObjectsEx IsIconic IsWindowVisible ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PostMessageW PeekMessageW DispatchMessageW TranslateMessage GetWindowThreadProcessId FindWindowW mouse_event GetAsyncKeyState SetWindowPos SetForegroundWindow

gdi32

SelectObject CreateRoundRectRgn CreateCompatibleDC DeleteDC DeleteObject GetObjectW CreateDIBSection

advapi32

EnableTraceEx2 OpenProcessToken GetTokenInformation ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW StartTraceW ControlTraceW OpenTraceW ProcessTrace CloseTrace RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW

shell32

ExtractIconExW ShellExecuteW ShellExecuteExW CommandLineToArgvW SHGetKnownFolderPath

bcrypt

BCryptGenRandom

ntdll

RtlNtStatusToDosError NtQueryInformationProcess

crypt32

CryptUnprotectData

iphlpapi

GetPerTcpConnectionEStats SetPerTcpConnectionEStats IcmpCreateFile IcmpCloseHandle IcmpSendEcho GetExtendedTcpTable

winmm

PlaySoundA timeBeginPeriod timeEndPeriod

ws2_32

ntohl

dcomp

DCompositionCreateDevice

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

392KB

Virtual Size

392KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20.7MB

Virtual Size

20.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_def1dbd1f7d6f2dd0e9f4b812928ad5a_cobalt-strike_icedid_njrat_satacom_stealc

d3d11

d3dcompiler_47

dxgi

dwmapi

ole32

kernel32

user32

gdi32

advapi32

shell32

bcrypt

ntdll

crypt32

iphlpapi

winmm

ws2_32

dcomp

imm32

generic