2026-10-06_654a4b89d27ccccc4e714b9ceec408a7_cobalt-strike_icedid_satacom

General

Target
2026-10-06_654a4b89d27ccccc4e714b9ceec408a7_cobalt-strike_icedid_satacom
Size 1.2MB
Sample261006-p4bsjayv3j
SHA256 ab8845502e776d2628c202fd4056fa418e84a400ede2ecb12c996a0730fc5b45
MD5 654a4b89d27ccccc4e714b9ceec408a7
SHA1 62075f5172db5b0673d693b18aff712e1df579d4
SHA512 ac34c928b7643dcd9f0570a719690332117968a8b1717ad1519984c3b50448dc416a0ec4da7e997f0dd24f50e41c1f6a8636e19ab54f9701777a7a365dcb61e1
SSDEEP 24576:Rdj5gk32VVs54PuaR/qFHSj9pf8B2DJUE2:PdgkGVKyuaR/qAP8B2Dn
TLSH
T1DC450956B12427D1E0B382B01A438174F7B0B8B89F655D3374CEA3352F1B94D8E7A79A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-06_654a4b89d27ccccc4e714b9ceec408a7_cobalt-strike_icedid_satacom

File Explorer

2026-10-06_654a4b89d27ccccc4e714b9ceec408a7_cobalt-strike_icedid_satacom

.exe 1.2MB

2026-10-06_654a4b89d27ccccc4e714b9ceec408a7_cobalt-strike_icedid_satacom

IMPHASH 8178cac8fb781d5a369db098dc713fd9
SHA256 ab8845502e776d2628c202fd4056fa418e84a400ede2ecb12c996a0730fc5b45
MD5 654a4b89d27ccccc4e714b9ceec408a7
SHA1 62075f5172db5b0673d693b18aff712e1df579d4
SHA512 ac34c928b7643dcd9f0570a719690332117968a8b1717ad1519984c3b50448dc416a0ec4da7e997f0dd24f50e41c1f6a8636e19ab54f9701777a7a365dcb61e1
SSDEEP 24576:Rdj5gk32VVs54PuaR/qFHSj9pf8B2DJUE2:PdgkGVKyuaR/qAP8B2Dn
TLSH
T1DC450956B12427D1E0B382B01A438174F7B0B8B89F655D3374CEA3352F1B94D8E7A79A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

19408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

cargo_clippy-82cb13605d9f5e0b.pdb

kernel32

GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetConsoleMode SetLastError CloseHandle GetStdHandle FreeLibrary SetStdHandle GetConsoleOutputCP WriteConsoleW GetLastError IsDebuggerPresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW CreateFileW SetFilePointerEx FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetStringTypeW GetFileType SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapFree HeapAlloc UnhandledExceptionFilter GetModuleHandleW IsProcessorFeaturePresent GetCommandLineW GetCommandLineA GetProcAddress GetModuleHandleExW TerminateProcess ExitProcess GetCurrentProcess GetModuleFileNameW WriteFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection RaiseException EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc QueryPerformanceCounter

rustc_driver-ef8869f0b4ce2a70

_RNvNtNtCsdtyQ4pYLUp8_4core5slice5index16slice_index_fail _RNvNtNtCsgpNh8ZMRi9S_3std2io5stdio6__print _RNvMs0_NtNtNtNtCsgpNh8ZMRi9S_3std3sys4sync4once5futexNtB5_4Once4call _RNvXs4_NtCs7wFdHJfxU4j_5alloc6stringNtB5_6StringNtNtCsdtyQ4pYLUp8_4core5clone5Clone5clone _RNvMsf_NtNtNtCsdtyQ4pYLUp8_4core3fmt3num3impy4__fmt _RNvXNtNtNtCsdtyQ4pYLUp8_4core3fmt3num3imphNtB6_7Display3fmt _RNvMs7_CshomrjssbiOh_15rustc_lint_defsNtB5_4Lint10name_lower _RNvMsa_NtCsdtyQ4pYLUp8_4core3fmtNtB5_9Formatter9write_str _RNvXsb_NtCsdtyQ4pYLUp8_4core3fmtNtB5_9FormatterNtB5_5Write10write_char _RNvMsa_NtNtNtCsdtyQ4pYLUp8_4core3fmt3num3impm4__fmt _RNvXsh_NtCsdtyQ4pYLUp8_4core3fmteNtB5_5Debug3fmt _RNvXs3_NtNtNtCsdtyQ4pYLUp8_4core3fmt3num3imptNtB9_7Display3fmt _RNvNtNtNtCsdtyQ4pYLUp8_4core2io5error12os_functions16get_os_functions _RNvMs4_NtCs7wFdHJfxU4j_5alloc7raw_vecINtB5_6RawVechE8grow_oneB7_ _RINvMNtNtCs7wFdHJfxU4j_5alloc2io5errorNtNtNtCsdtyQ4pYLUp8_4core2io5error5Error3newReECsgpNh8ZMRi9S_3std _RNvNtNtNtCsgpNh8ZMRi9S_3std3sys3env7windows6getenv _RNvNvNtNtCsgpNh8ZMRi9S_3std2io5stdio6stderr8INSTANCE _RNvNtNtCsgpNh8ZMRi9S_3std2io5stdio6stdout _RNvXs1_NtNtNtNtCsgpNh8ZMRi9S_3std2os7windows2io3rawNtNtNtBd_2io5stdio6StderrNtB5_11AsRawHandle13as_raw_handle _RNvNtNtNtNtCsgpNh8ZMRi9S_3std3sys2io11is_terminal7windows17handle_is_console _RNvXs0_NtNtNtNtCsgpNh8ZMRi9S_3std2os7windows2io3rawNtNtNtBd_2io5stdio6StdoutNtB5_11AsRawHandle13as_raw_handle _RNvXsd_NtNtCsgpNh8ZMRi9S_3std2io5stdioNtB5_6StdoutNtNtNtCsdtyQ4pYLUp8_4core2io5write5Write5write _RNvXsd_NtNtCsgpNh8ZMRi9S_3std2io5stdioNtB5_6StdoutNtNtNtCsdtyQ4pYLUp8_4core2io5write5Write14write_vectored _RNvXsd_NtNtCsgpNh8ZMRi9S_3std2io5stdioNtB5_6StdoutNtNtNtCsdtyQ4pYLUp8_4core2io5write5Write5flush _RNvXsd_NtNtCsgpNh8ZMRi9S_3std2io5stdioNtB5_6StdoutNtNtNtCsdtyQ4pYLUp8_4core2io5write5Write9write_all _RNvXsd_NtNtCsgpNh8ZMRi9S_3std2io5stdioNtB5_6StdoutNtNtNtCsdtyQ4pYLUp8_4core2io5write5Write18write_all_vectored _RNvXsd_NtNtCsgpNh8ZMRi9S_3std2io5stdioNtB5_6StdoutNtNtNtCsdtyQ4pYLUp8_4core2io5write5Write9write_fmt _RNvNtNtNtNtCsgpNh8ZMRi9S_3std3sys2io5error7windows5errno _RNvNtNtNtCsdtyQ4pYLUp8_4core2io5error12os_functions12OS_FUNCTIONS _RNvNvNtNtNtCsdtyQ4pYLUp8_4core2io5error12os_functions13set_functions19set_functions_inner _RNvNtNtNtNtCsgpNh8ZMRi9S_3std3sys2io5error7windows12format_error _RNvXs3_NtNtNtNtCsgpNh8ZMRi9S_3std2os7windows2io3rawNtNtNtBd_2io5stdio10StdoutLockNtB5_11AsRawHandle13as_raw_handle _RNvNtNtNtCsdtyQ4pYLUp8_4core7unicode12unicode_data11white_space14WHITESPACE_MAP _RNvNtNtCsdtyQ4pYLUp8_4core5slice6memchr14memchr_aligned _RNvNvNtCs7wFdHJfxU4j_5alloc3fmt6format12format_inner _RNvNtCsdtyQ4pYLUp8_4core9panicking18panic_bounds_check _RNvNtCsdtyQ4pYLUp8_4core6option13expect_failed _RNvNtCs7wFdHJfxU4j_5alloc5alloc18handle_alloc_error _RNvXNtNtCsdtyQ4pYLUp8_4core2io5errorNtB2_5ErrorNtNtB6_3fmt5Debug3fmt _RNvXsh_NtNtCsgpNh8ZMRi9S_3std2io5stdioNtB5_10StdoutLockNtNtNtCsdtyQ4pYLUp8_4core2io5write5Write5write _RNvXsh_NtNtCsgpNh8ZMRi9S_3std2io5stdioNtB5_10StdoutLockNtNtNtCsdtyQ4pYLUp8_4core2io5write5Write5flush _RNvXsh_NtNtCsgpNh8ZMRi9S_3std2io5stdioNtB5_10StdoutLockNtNtNtCsdtyQ4pYLUp8_4core2io5write5Write18write_all_vectored _RNvNtCsdtyQ4pYLUp8_4core4cell22panic_already_borrowed _RNvXsh_NtNtCsgpNh8ZMRi9S_3std2io5stdioNtB5_10StdoutLockNtNtNtCsdtyQ4pYLUp8_4core2io5write5Write14write_vectored _RNvXsi_NtCsdtyQ4pYLUp8_4core3fmteNtB5_7Display3fmt _RNvNtCsdtyQ4pYLUp8_4core9panicking9panic_fmt _RNvNtCsdtyQ4pYLUp8_4core3fmt5write _RNvXsh_NtNtCsgpNh8ZMRi9S_3std2io5stdioNtB5_10StdoutLockNtNtNtCsdtyQ4pYLUp8_4core2io5write5Write9write_all _RNvNtCsgpNh8ZMRi9S_3std7process4exit _RNvNtCsdtyQ4pYLUp8_4core6result13unwrap_failed _RNvMsT_NtCsgpNh8ZMRi9S_3std7processNtB5_5Child4wait _RNvMsi_NtCsgpNh8ZMRi9S_3std7processNtB5_7Command5spawn _RNvMs8_NtNtNtCsgpNh8ZMRi9S_3std3sys7process7windowsNtB5_7Command3arg _RNvMs_NtNtNtCsgpNh8ZMRi9S_3std3sys7process3envNtB4_10CommandEnv3set _RNvMsr_NtCsgpNh8ZMRi9S_3std4pathNtB5_7PathBuf14__set_extension _RNvMs16_NtCsgpNh8ZMRi9S_3std4pathNtB6_4Path15__with_file_name _RNvNtCsgpNh8ZMRi9S_3std3env11current_exe _RNvMs8_NtNtNtCsgpNh8ZMRi9S_3std3sys7process7windowsNtB5_7Command3new _RNvNvNtCsgpNh8ZMRi9S_3std3env3var5inner _RNvMs4_NtCs7wFdHJfxU4j_5alloc7raw_vecINtB5_6RawVecNtNtB7_6string6StringE8grow_oneCs1G4qaJZSeQt_12regex_syntax _RNvMs9_NtNtCsgpNh8ZMRi9S_3std2io5stdioNtB5_6Stdout4lock _RNvXsc_NtCsgpNh8ZMRi9S_3std3envNtB5_4ArgsNtNtNtNtCsdtyQ4pYLUp8_4core4iter6traits8iterator8Iterator4next _RNvNtCsgpNh8ZMRi9S_3std3env4args _RNvCsflx07Zc8M7l_7___rustc12___rust_alloc _RNvCsflx07Zc8M7l_7___rustc35___rust_no_alloc_shim_is_unstable_v2 _RNvCsflx07Zc8M7l_7___rustc14___rust_realloc _RNvNtCs7wFdHJfxU4j_5alloc7raw_vec12handle_error _RNvNtCsgpNh8ZMRi9S_3std2rt19lang_start_internal _RNvNtCsdtyQ4pYLUp8_4core6option13unwrap_failed _RNvMNtNtNtNtCsgpNh8ZMRi9S_3std3sys4sync5mutex5futexNtB2_5Mutex4wake _RNvCsflx07Zc8M7l_7___rustc14___rust_dealloc _RNvXsd_NtNtCsdtyQ4pYLUp8_4core2io5errorNtB5_11CustomOwnerNtNtNtB9_3ops4drop4Drop4drop

ntdll

RtlCaptureContext RtlVirtualUnwind RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry

Name

.text

Size

236KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

917KB

Virtual Size

916KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-06_654a4b89d27ccccc4e714b9ceec408a7_cobalt-strike_icedid_satacom

kernel32

rustc_driver-ef8869f0b4ce2a70

ntdll

generic