2026-10-06_2c544018628960b1d00666c29ba5c61c_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-06_2c544018628960b1d00666c29ba5c61c_cobalt-strike_icedid_njrat_satacom_stealc
Size 2.2MB
Sample261006-ryjmasfc52
SHA256 7b2f460dc196f6a62efd398f58143f81c9c16263f1365839f6c8c947b8e6f9c9
MD5 2c544018628960b1d00666c29ba5c61c
SHA1 977ebeda79db0f1fb716e75709a6d64bc5e93369
SHA512 bdcf700557b82e1610eab77e7703e44a15dfea134a4d9c832349ec7e1aa610259bbfe8b3547f61d0cda9289f4872c094e283a804cc410c2b1dfffd82190bacf6
SSDEEP 49152:ba2bhGgmFVrD2L6cDBL1JG3luwLbDpKHUg9XJg9LAg:nbwxr6LDG3lxbDpYXaH
TLSH
T194A58D57A2B900EDD067C1B9CA165613E772B4450730BBDF13908AA62F27BE15BBF720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-06_2c544018628960b1d00666c29ba5c61c_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-06_2c544018628960b1d00666c29ba5c61c_cobalt-strike_icedid_njrat_satacom_stealc

.exe 2.2MB

2026-10-06_2c544018628960b1d00666c29ba5c61c_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 912b8bc5d275f671c2b20b082f8b3cbc
SHA256 7b2f460dc196f6a62efd398f58143f81c9c16263f1365839f6c8c947b8e6f9c9
MD5 2c544018628960b1d00666c29ba5c61c
SHA1 977ebeda79db0f1fb716e75709a6d64bc5e93369
SHA512 bdcf700557b82e1610eab77e7703e44a15dfea134a4d9c832349ec7e1aa610259bbfe8b3547f61d0cda9289f4872c094e283a804cc410c2b1dfffd82190bacf6
SSDEEP 49152:ba2bhGgmFVrD2L6cDBL1JG3luwLbDpKHUg9XJg9LAg:nbwxr6LDG3lxbDpYXaH
TLSH
T194A58D57A2B900EDD067C1B9CA165613E772B4450730BBDF13908AA62F27BE15BBF720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

16:5b:21:36:87:eb:62:c5:ea:4c:63:cd:c1:e2:15:5f:55:8e:10:2e:51:a0:84:4a:95:0f:10:11:38:18:5b:e4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation

Chains

Oct 5, 2026

CN=Microsoft Corporation

Subject

CN=Microsoft Corporation

Serial Number

7a:27:58:ba:72:1b:b5:b5:4c:9b:5a:84:6f:94:e1:b3

Issuer

CN=Microsoft Corporation

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 4, 2026 - Oct 4, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

1442704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptOpenAlgorithmProvider

ole32

CoTaskMemFree CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoInitializeEx CoUninitialize

shell32

SHGetKnownFolderPath

advapi32

RegGetValueW CheckTokenMembership FreeSid AllocateAndInitializeSid

ws2_32

WSAStartup htonl listen recv bind select closesocket htons send WSACleanup __WSAFDIsSet socket setsockopt accept

oleaut32

VariantInit VariantClear SysFreeString SysAllocString

winhttp

WinHttpCloseHandle WinHttpCrackUrl WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpOpen

gdi32

CreateCompatibleBitmap DeleteDC DeleteObject SelectObject BitBlt CreateCompatibleDC

user32

GetDC GetSystemMetrics ReleaseDC

gdiplus

GdipCloneImage GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipSaveImageToFile GdipDisposeImage GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipGetImageEncodersSize

kernel32

SetFilePointerEx GetConsoleMode GetConsoleOutputCP ReadConsoleW GetExitCodeProcess GetTimeZoneInformation IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetACP LoadLibraryExW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA ExitProcess IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW GetDateFormatW InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork GetStdHandle GetFileType GetTempPathW Sleep GetCurrentProcessId GetEnvironmentVariableW GetFileSizeEx GetFinalPathNameByHandleW ReadFile WriteFile CloseHandle GetLastError ConnectNamedPipe CreateNamedPipeW WaitForSingleObject CreateEventW GetCurrentProcess TerminateProcess CreateRemoteThread GetCurrentThreadId CreateProcessW OpenProcess GetTickCount64 VirtualAllocEx WriteProcessMemory VirtualFreeEx FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryA LoadLibraryW LocalFree SetDllDirectoryW GetComputerNameW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW VirtualQueryEx ReadProcessMemory Process32First Process32Next FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetProcessHeap GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact HeapAlloc GetSystemInfo HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapFree HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetExitCodeThread GetLogicalProcessorInformationEx GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 CopyFile2 GetFileInformationByHandleEx RtlPcToFileHeader GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete FreeLibraryWhenCallbackReturns RtlUnwind

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

444KB

Virtual Size

443KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-06_2c544018628960b1d00666c29ba5c61c_cobalt-strike_icedid_njrat_satacom_stealc

PE Signature issue

crypt32

bcrypt

ole32

shell32

advapi32

ws2_32

oleaut32

winhttp

gdi32

user32

gdiplus

kernel32

generic