2026-09-30_2f3ba9305cbc5789189f54626c91e7c3_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_2f3ba9305cbc5789189f54626c91e7c3_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.1MB
Sample261001-t8fphage49
SHA256 79cf1f5cf017db18c531933ab0df2f85be523dad8233ae7e2b07cf7bfdd31038
MD5 2f3ba9305cbc5789189f54626c91e7c3
SHA1 393e267be5d308816eaec670ec1e3c6ef95cd860
SHA512 beaadb0bc577b7575e159ae16965a0a0657f88aa008dc48e1a694040fc1494fbd08e673089fc2cced358bf719fc1065f9ccd0f51cfe617e8eef5db2d8d347c17
SSDEEP 24576:cjTE5ekRTNR+NiT5G7GEgio3Q1LH6b3OMefL8mT:cnEhSN2pEgio3smb3O1ZT
TLSH
T14A457E21A6E801F8D177D2B8CF669903E77678460730A9DF07D0A6562F27ED05B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_2f3ba9305cbc5789189f54626c91e7c3_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-09-30_2f3ba9305cbc5789189f54626c91e7c3_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.1MB

2026-09-30_2f3ba9305cbc5789189f54626c91e7c3_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH c19ff59a05dd40f0d133b71be2c4b582
SHA256 79cf1f5cf017db18c531933ab0df2f85be523dad8233ae7e2b07cf7bfdd31038
MD5 2f3ba9305cbc5789189f54626c91e7c3
SHA1 393e267be5d308816eaec670ec1e3c6ef95cd860
SHA512 beaadb0bc577b7575e159ae16965a0a0657f88aa008dc48e1a694040fc1494fbd08e673089fc2cced358bf719fc1065f9ccd0f51cfe617e8eef5db2d8d347c17
SSDEEP 24576:cjTE5ekRTNR+NiT5G7GEgio3Q1LH6b3OMefL8mT:cnEhSN2pEgio3smb3O1ZT
TLSH
T14A457E21A6E801F8D177D2B8CF669903E77678460730A9DF07D0A6562F27ED05B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

632736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

ord17

comdlg32

GetSaveFileNameW GetOpenFileNameW ChooseColorW

shell32

ShellExecuteW SHGetKnownFolderPath CommandLineToArgvW Shell_NotifyIconW

dwmapi

DwmSetWindowAttribute

uxtheme

SetWindowTheme

winmm

PlaySoundW

winhttp

WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest

d3dcompiler_47

D3DCompile

d3d11

D3D11CreateDeviceAndSwapChain

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData

user32

GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage VkKeyScanW IsWindow SystemParametersInfoW LoadImageW LoadIconW LoadCursorW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindowThreadProcessId EnumChildWindows SetWindowLongPtrW GetWindowLongPtrW PtInRect UnionRect InflateRect FillRect WindowFromPoint ScreenToClient GetCursorPos SetCursor MessageBeep TrackMouseEvent GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW InvalidateRect SetWindowRgn EndPaint BeginPaint SetForegroundWindow GetForegroundWindow UpdateWindow DrawTextW TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu GetSystemMetrics EnableWindow KillTimer SetTimer ReleaseCapture SetCapture GetCapture MapVirtualKeyW SendInput SetWindowPos MoveWindow SetLayeredWindowAttributes ShowWindow DestroyWindow IsChild CreateWindowExW RegisterClassExW MessageBoxW

ole32

CoInitializeEx CoUninitialize CoTaskMemFree

kernel32

TerminateProcess ExitProcess WriteFile GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCPInfo LCMapStringEx DecodePointer EncodePointer SleepConditionVariableSRW WakeAllConditionVariable DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetStringTypeW QueryPerformanceFrequency QueryPerformanceCounter AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx AreFileApisANSI CreateFile2 GetTempPathW SetFileInformationByHandle SetEndOfFile WriteConsoleW HeapSize SetStdHandle FreeEnvironmentStringsW GetCommandLineW CloseHandle GetLastError ReleaseMutex CreateMutexW OpenProcess GetTickCount64 GetModuleFileNameW QueryFullProcessImageNameW GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW CopyFileW MultiByteToWideChar WideCharToMultiByte GetEnvironmentVariableW WaitForSingleObject Sleep GetCurrentProcessId LocalFree MoveFileExW GetPrivateProfileSectionW CreateFileW GetFileSizeEx ReadFile GetFileAttributesW OutputDebugStringA OutputDebugStringW GetProcAddress GetProcessHeap HeapFree GetModuleHandleW LoadLibraryExW GetCurrentProcess LocalAlloc LoadLibraryW FreeLibrary GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW GetEnvironmentStringsW GetCommandLineA HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW RtlUnwind LCMapStringW FindClose VirtualProtect GetFileType HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind CreateDirectoryW FormatMessageA GetLocaleInfoEx GetCurrentThreadId RtlCaptureContext

gdi32

SetTextColor SetStretchBltMode StretchBlt CreateDIBSection MoveToEx GetObjectW SetPixelV SetBkMode SetBkColor SelectObject RoundRect LineTo GetStockObject GetCurrentObject Ellipse DeleteObject DeleteDC CreateSolidBrush CreateRoundRectRgn CreatePen CreateFontW CreateCompatibleDC CreateCompatibleBitmap BitBlt

advapi32

EventRegister RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW EventSetInformation GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation OpenProcessToken RegGetValueW EventUnregister EventWriteTransfer RegSetValueExW

Name

.text

Size

819KB

Virtual Size

818KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_2f3ba9305cbc5789189f54626c91e7c3_cobalt-strike_icedid_njrat_satacom_stealc

comctl32

comdlg32

shell32

dwmapi

uxtheme

winmm

winhttp

d3dcompiler_47

d3d11

bcrypt

user32

ole32

kernel32

gdi32

advapi32

generic