2026-10-01_6cb66628972820cfad4ab9f7eae4c449_cobalt-strike_icedid_satacom

General

Target
2026-10-01_6cb66628972820cfad4ab9f7eae4c449_cobalt-strike_icedid_satacom
Size 100KB
Sample261002-pwf3aaab35
SHA256 588f614a66b11820b30513c0bff5b5d3e73c05ecff8509da259d4593e53166ab
MD5 6cb66628972820cfad4ab9f7eae4c449
SHA1 8e65db2dd538c2873c9774e2f0bd1a66d9f17b93
SHA512 b60cc9cce92d1ba585cb30266638606a86c458f08d308984a9d851cc88adfd89ba0319b51eddc41b466f6fe42a292b3023c0682ff1535126d63297e536c44315
SSDEEP 3072:w6x8KS0LhFPICWdqtpYqvtuL7twPxKYddwHNx:O0LhFPITbqvt4KfwHN
TLSH
T17BA33997B3E930F9E1B7863884954A05D771F8351B619FEF03A0429A1F237E49D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_6cb66628972820cfad4ab9f7eae4c449_cobalt-strike_icedid_satacom

File Explorer

2026-10-01_6cb66628972820cfad4ab9f7eae4c449_cobalt-strike_icedid_satacom

.exe 100KB

2026-10-01_6cb66628972820cfad4ab9f7eae4c449_cobalt-strike_icedid_satacom

IMPHASH 79baf1e9c48e4f3c374bd52c67ba3cda
SHA256 588f614a66b11820b30513c0bff5b5d3e73c05ecff8509da259d4593e53166ab
MD5 6cb66628972820cfad4ab9f7eae4c449
SHA1 8e65db2dd538c2873c9774e2f0bd1a66d9f17b93
SHA512 b60cc9cce92d1ba585cb30266638606a86c458f08d308984a9d851cc88adfd89ba0319b51eddc41b466f6fe42a292b3023c0682ff1535126d63297e536c44315
SSDEEP 3072:w6x8KS0LhFPICWdqtpYqvtuL7twPxKYddwHNx:O0LhFPITbqvt4KfwHN
TLSH
T17BA33997B3E930F9E1B7863884954A05D771F8351B619FEF03A0429A1F237E49D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

6

Entry point

4736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_APPCONTAINER IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winstore.app

__managed__Main

api-ms-win-crt-string-l1-1-0

memset

kernel32

HeapFree CreateFileW WriteConsoleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CloseHandle

api-ms-win-core-com-l1-1-0

CoIncrementMTAUsage

Name

.text

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_6cb66628972820cfad4ab9f7eae4c449_cobalt-strike_icedid_satacom

winstore.app

api-ms-win-crt-string-l1-1-0

kernel32

api-ms-win-core-com-l1-1-0

generic