2026-10-06_70b1de5f25fdca2a69b8bb3045c28c6c_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-10-06_70b1de5f25fdca2a69b8bb3045c28c6c_cobalt-strike_icedid_njrat_satacom_stealc
Size 222KB
Sample261006-pm9m8sys9q
SHA256 1bc0ec0848bb1004fce517fa45b56c4418285c2763704bebd8ea38267835d841
MD5 70b1de5f25fdca2a69b8bb3045c28c6c
SHA1 6b4e8e2a3599e1bfdede560736a89c5569f1df66
SHA512 18ee8def4e662d5588af59f5a9eba248627c4aadb9acc6d866cf9fc349e7eec7ca9320a96d2b8a1fe2c7f786ad21e58da846323041ccfc22fabf3e70ca294573
SSDEEP 3072:o6pctEVq/8hqaonUNK1BJIli6vy3pqtynpLdAT+PZJdXAC5GdvngkWERkQRX:o6pctEVq/8hfoU8c8GyI+R3XoYUX
TLSH
T151248D14B6E508FEE6B78579C9A24502DB737C424770DADF03904AA69F236D0DE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-06_70b1de5f25fdca2a69b8bb3045c28c6c_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-06_70b1de5f25fdca2a69b8bb3045c28c6c_cobalt-strike_icedid_njrat_satacom_stealc

.exe 222KB

2026-10-06_70b1de5f25fdca2a69b8bb3045c28c6c_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 8ac45e2af74dcbe77b2a6839499efe7e
SHA256 1bc0ec0848bb1004fce517fa45b56c4418285c2763704bebd8ea38267835d841
MD5 70b1de5f25fdca2a69b8bb3045c28c6c
SHA1 6b4e8e2a3599e1bfdede560736a89c5569f1df66
SHA512 18ee8def4e662d5588af59f5a9eba248627c4aadb9acc6d866cf9fc349e7eec7ca9320a96d2b8a1fe2c7f786ad21e58da846323041ccfc22fabf3e70ca294573
SSDEEP 3072:o6pctEVq/8hqaonUNK1BJIli6vy3pqtynpLdAT+PZJdXAC5GdvngkWERkQRX:o6pctEVq/8hfoU8c8GyI+R3XoYUX
TLSH
T151248D14B6E508FEE6B78579C9A24502DB737C424770DADF03904AA69F236D0DE3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

42736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

DefWindowProcW GetWindow GetWindowThreadProcessId EnumWindows GetClientRect IsWindowVisible DestroyWindow CreateWindowExW UnregisterClassW RegisterClassW PostMessageW

shell32

ShellExecuteExW

kernel32

InitializeCriticalSectionEx WriteConsoleW CreateFileW HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetFileAttributesW CloseHandle GetLastError SetLastError WaitForSingleObject Sleep GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW ProcessIdToSessionId OpenProcess GetTickCount64 FreeLibrary GetModuleFileNameW GetModuleHandleW LoadLibraryW LocalFree FormatMessageW QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetCurrentProcess ExitProcess GetModuleHandleExW GetProcAddress GetStdHandle WriteFile GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap

Name

.text

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-06_70b1de5f25fdca2a69b8bb3045c28c6c_cobalt-strike_icedid_njrat_satacom_stealc

user32

shell32

kernel32

generic