2026-10-05_677630d8d037fd225e0bb847e662518e_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-05_677630d8d037fd225e0bb847e662518e_cobalt-strike_icedid_njrat_satacom_stealc
Size 583KB
Sample261006-2seq9sat5m
SHA256 82deff4002c0fedc5769f4c32c7e29d38c6c741e82d2189d318bef672882c069
MD5 677630d8d037fd225e0bb847e662518e
SHA1 585c1744b74aaa73783932b22624badc4d599920
SHA512 154935aa5b87852b0f0b8d0a5a3cf6b5fcaa6436aa0f302180b8e624d3997f0da734939dfd00e730f73309b309ca3b3d093eafd3851d99a5387ab6de261a5da4
SSDEEP 6144:AjNTyi/jd+lWTAXsV7CTsxvoVNE3ZVShzqzjgFWFgj/RUn5eXt06jkkNZa+UfuQi:AZvb7C43+CIWeseKk++UfuioTS8sUG+
TLSH
T141D46D21A69403FCE1B7D2B89E634916F77278460730AADF039099671F27AD45B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing commands for clearing Windows Event Logs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ClearWinLogs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-05_677630d8d037fd225e0bb847e662518e_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-05_677630d8d037fd225e0bb847e662518e_cobalt-strike_icedid_njrat_satacom_stealc

.exe 583KB

2026-10-05_677630d8d037fd225e0bb847e662518e_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 2d894b9b06d8e25a75572b8ce3ffea90
SHA256 82deff4002c0fedc5769f4c32c7e29d38c6c741e82d2189d318bef672882c069
MD5 677630d8d037fd225e0bb847e662518e
SHA1 585c1744b74aaa73783932b22624badc4d599920
SHA512 154935aa5b87852b0f0b8d0a5a3cf6b5fcaa6436aa0f302180b8e624d3997f0da734939dfd00e730f73309b309ca3b3d093eafd3851d99a5387ab6de261a5da4
SSDEEP 6144:AjNTyi/jd+lWTAXsV7CTsxvoVNE3ZVShzqzjgFWFgj/RUn5eXt06jkkNZa+UfuQi:AZvb7C43+CIWeseKk++UfuioTS8sUG+
TLSH
T141D46D21A69403FCE1B7D2B89E634916F77278460730AADF039099671F27AD45B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing commands for clearing Windows Event Logs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

227488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

iphlpapi

GetAdaptersAddresses

setupapi

SetupDiGetDeviceInstanceIdW SetupDiSetClassInstallParamsW SetupDiGetDeviceRegistryPropertyW CM_Enable_DevNode SetupDiEnumDeviceInfo SetupDiOpenDevRegKey SetupDiCallClassInstaller SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList CM_Disable_DevNode

advapi32

RegEnumKeyExW SetSecurityInfo SetEntriesInAclW OpenServiceW OpenSCManagerW ControlService CloseServiceHandle RegDeleteTreeW RegEnumValueW LookupPrivilegeValueW GetTokenInformation RegSetKeyValueW RegOpenKeyW RegCloseKey RegCreateKeyExW RegDeleteValueW RegCreateKeyW RegOpenKeyExW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges

shell32

SHEmptyRecycleBinW SHGetKnownFolderPath

ole32

CoTaskMemFree

kernel32

GetCommandLineW GetEnvironmentStringsW HeapReAlloc GetOEMCP GetACP CreateFileW GetDriveTypeW GetFileAttributesW GetFileSizeEx GetLogicalDriveStringsW ReadFile SetFilePointer SetFilePointerEx WriteFile GetTempPathW CloseHandle DeviceIoControl Sleep CreateThread GetLocalTime GetTickCount GetWindowsDirectoryW GetSystemFirmwareTable GetModuleFileNameW LoadResource LockResource SizeofResource FreeEnvironmentStringsW SetVolumeLabelW DeleteFileW RemoveDirectoryW SetFileAttributesW WaitForSingleObject GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW OpenProcess LocalFree CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetCurrentThreadId VirtualAlloc VirtualFree GetModuleHandleA GetProcAddress IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleHandleExW FreeLibrary ExitProcess IsProcessorFeaturePresent FlsFree FlsSetValue FlsGetValue FlsAlloc GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile GetCommandLineA FindResourceW SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive RtlUnwind GetCPInfo LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetStringTypeW WideCharToMultiByte MultiByteToWideChar GetFileInformationByHandleEx GetModuleHandleW GetLastError CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose GetLocaleInfoEx FormatMessageA

user32

SetWindowPos TrackMouseEvent GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow ShowWindow SetLayeredWindowAttributes CreateIconIndirect IsWindowVisible ReleaseCapture SetTimer KillTimer GetSystemMetrics UpdateWindow GetDC ReleaseDC BeginPaint EndPaint InvalidateRect GetWindowRect MessageBoxW SetCursor LoadCursorA DestroyCursor

gdi32

CreateDIBSection BitBlt CreateBitmap CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject

ntdll

NtLoadDriver NtQuerySystemInformation RtlInitUnicodeString RtlAdjustPrivilege NtUnloadDriver

gdiplus

GdipCreateStringFormat GdipDeleteStringFormat GdipCreateSolidFill GdipDrawString GdipDeleteFont GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCreatePath GdipDeletePath GdipClosePathFigure GdipAddPathArc GdipCloneBrush GdipDeleteBrush GdipSetSolidFillColor GdipCreatePen1 GdipDeletePen GdipSetPenStartCap GdipSetPenEndCap GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetTextRenderingHint GdipTranslateWorldTransform GdipDrawLine GdipDrawArc GdipDrawRectangleI GdipDrawEllipse GdipDrawPath GdipFillRectangle GdipFillRectangleI GdipFillEllipse GdipFillPath GdipSetClipRect GdipResetClip GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipSaveGraphics GdipRestoreGraphics GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipSetStringFormatFlags GdipCreateFont

dwmapi

DwmSetWindowAttribute

Name

.text

Size

373KB

Virtual Size

373KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

148KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-05_677630d8d037fd225e0bb847e662518e_cobalt-strike_icedid_njrat_satacom_stealc

iphlpapi

setupapi

advapi32

shell32

ole32

kernel32

user32

gdi32

ntdll

gdiplus

dwmapi

generic