2026-10-01_e51bc63b9e4f9c672f9db494c78585fc_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_e51bc63b9e4f9c672f9db494c78585fc_cobalt-strike_icedid_njrat_satacom_stealc
Size 4.0MB
Sample261003-xd41dsvekb
SHA256 4ccbe2d2b2d41a877508564be99961e0afbcf40340394d619514b12c92c79772
MD5 e51bc63b9e4f9c672f9db494c78585fc
SHA1 1c373592299a8aa6c4af8b524ec040b9b76079f5
SHA512 f7c782dcbf1ae48873c71cbaabc5429550e09c9ad2427b6de119dba7b18e5a435b23bb9dd7cbfff3d45f40c3401e743fb11975cce5978ffdff7eb2e6c6bcda3d
SSDEEP 49152:2jOyhhOsIMazojRWson6ln/9feIlJQ7zrSfcbAwQ309GjlgGiM6/I84RUSan6Nvb:ShLIIlmwF0GxgHAh+Gjx
TLSH
T14716BF12F3A542ECC12B9138D656AB1BF331784507206BDB23E41E556FA7AE01FBE391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ClearWinLogs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_e51bc63b9e4f9c672f9db494c78585fc_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-01_e51bc63b9e4f9c672f9db494c78585fc_cobalt-strike_icedid_njrat_satacom_stealc

.exe 4.0MB

2026-10-01_e51bc63b9e4f9c672f9db494c78585fc_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 5eb91ad3a433eae3f50c5ba9d5f40d21
SHA256 4ccbe2d2b2d41a877508564be99961e0afbcf40340394d619514b12c92c79772
MD5 e51bc63b9e4f9c672f9db494c78585fc
SHA1 1c373592299a8aa6c4af8b524ec040b9b76079f5
SHA512 f7c782dcbf1ae48873c71cbaabc5429550e09c9ad2427b6de119dba7b18e5a435b23bb9dd7cbfff3d45f40c3401e743fb11975cce5978ffdff7eb2e6c6bcda3d
SSDEEP 49152:2jOyhhOsIMazojRWson6ln/9feIlJQ7zrSfcbAwQ309GjlgGiM6/I84RUSan6Nvb:ShLIIlmwF0GxgHAh+Gjx
TLSH
T14716BF12F3A542ECC12B9138D656AB1BF331784507206BDB23E41E556FA7AE01FBE391
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing commands for clearing Windows Event Logs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

685280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Process32FirstW CloseHandle LoadResource FindResourceW Module32FirstW GlobalLock GetModuleHandleW WideCharToMultiByte Module32NextW CreateProcessA GetSystemTime GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter WriteConsoleW HeapSize CreateFileW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetStringTypeW GetConsoleOutputCP FlushFileBuffers MultiByteToWideChar GlobalAlloc LCMapStringW LoadLibraryExW VirtualProtect ReadConsoleW GetConsoleMode SetFilePointerEx GetFileType UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleFileNameW CreateToolhelp32Snapshot OpenProcess CreateMutexA TerminateProcess WriteFile SizeofResource GetModuleHandleExW ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetCPInfo DeleteCriticalSection DeleteFileA LockResource CreateFileA Process32NextW InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection RtlUnwind EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError GetLastError CopyFileA GetTempPathA Sleep GetModuleFileNameA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetFileInformationByHandleEx SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetEndOfFile

user32

TranslateMessage CreateWindowExA DefWindowProcA RegisterClassA MessageBoxA SetClipboardData EmptyClipboard CloseClipboard DispatchMessageW OpenClipboard DestroyWindow GetCursorPos GetClipboardData IsClipboardFormatAvailable PeekMessageW GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos

shell32

SHGetFolderPathA ShellExecuteA

advapi32

RegSetValueExA RegCloseKey RegQueryValueExA RegCreateKeyExA RegOpenKeyExA

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

808KB

Virtual Size

808KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

255KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_e51bc63b9e4f9c672f9db494c78585fc_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

shell32

advapi32

d3d11

winhttp

imm32

d3dcompiler_47

generic