2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc
Size 438KB
Sample261003-vbbjyst1ev
SHA256 e4c23b54e77b505ef0979703d6bcbca8a85da715fe6c97c7ffdf97f1c9178d0b
MD5 169d59eea71aca2fda3e0ac2817a72fe
SHA1 0310b3dcd31bde0108afac9d0b341baa5799394e
SHA512 126f7911f7b78426664bb7052d6314e5f57496d2e503d5ccda42ca549e6776a4857b03038b2eb1a303a840cefe73589d0fad64b2475669b6b30ff0c1e03be687
SSDEEP 6144:4hJzQ4lWTEy43F93CFoaaVEldei7eizrgV+gLZyqkuU30iewqyFJ8++lrgVn/2xs:4HQE9BMvJc+8yt5lLP8hOy
TLSH
T188947C25A6A900F9E277D57CC9634902EB767C464320E6CF03A899A61F337D49E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables (downlaoders) containing URLs to raw contents of a paste 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc

.exe 438KB

2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 5adeac070f95ba8f4169a48ed3c90cfb
SHA256 e4c23b54e77b505ef0979703d6bcbca8a85da715fe6c97c7ffdf97f1c9178d0b
MD5 169d59eea71aca2fda3e0ac2817a72fe
SHA1 0310b3dcd31bde0108afac9d0b341baa5799394e
SHA512 126f7911f7b78426664bb7052d6314e5f57496d2e503d5ccda42ca549e6776a4857b03038b2eb1a303a840cefe73589d0fad64b2475669b6b30ff0c1e03be687
SSDEEP 6144:4hJzQ4lWTEy43F93CFoaaVEldei7eizrgV+gLZyqkuU30iewqyFJ8++lrgVn/2xs:4HQE9BMvJc+8yt5lLP8hOy
TLSH
T188947C25A6A900F9E277D57CC9634902EB767C464320E6CF03A899A61F337D49E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables (downlaoders) containing URLs to raw contents of a paste
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

140928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ResumeThread GetModuleHandleA OpenProcess SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar GetLastError Process32NextW GetCurrentThread DeleteFileW Process32FirstW CloseHandle GetNativeSystemInfo VirtualProtectEx SetCurrentDirectoryW Beep GetProcAddress ExitProcess ReadProcessMemory GetComputerNameW SetConsoleCP GetSystemDirectoryW CreateProcessW GetModuleHandleW WideCharToMultiByte GetConsoleWindow SetConsoleOutputCP SetProcessWorkingSetSize SetConsoleTitleW OpenThread VirtualQueryEx SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW HeapReAlloc GetOEMCP SuspendThread GetCurrentThreadId GetFileAttributesW CreateFileW FindClose Thread32First CreateMutexW GetTempPathW GetEnvironmentVariableW Thread32Next SetThreadPriority GetModuleFileNameW TerminateProcess GetStdHandle GetCurrentProcess FindNextFileW SetConsoleTextAttribute SetPriorityClass VirtualProtect WriteProcessMemory FindFirstFileW GlobalMemoryStatusEx GetVolumeInformationW GetACP IsValidCodePage QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent WriteFile GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree FlushFileBuffers GetConsoleOutputCP GetConsoleMode LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW WaitForSingleObject GetExitCodeProcess GetFileAttributesExW ReadFile ReadConsoleW RtlUnwind

wininet

InternetCloseHandle InternetConnectW InternetReadFile InternetOpenA HttpSendRequestW InternetOpenW InternetOpenUrlA HttpOpenRequestW InternetSetOptionA

user32

GetAsyncKeyState

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey CloseServiceHandle RegQueryValueExA OpenSCManagerW RegCreateKeyExW CloseEventLog ClearEventLogA RegEnumKeyExW RegSetValueExW OpenEventLogA RegSetValueExA OpenProcessToken StartServiceW RegOpenKeyExA RegOpenKeyExW RegDeleteValueW OpenServiceW QueryServiceStatusEx RegQueryValueExW GetTokenInformation

shell32

ShellExecuteExW

Name

.text

Size

299KB

Virtual Size

298KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_169d59eea71aca2fda3e0ac2817a72fe_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

wininet

user32

advapi32

shell32

generic