2026-10-08_5da028523e374dfe218da9c3cc32a8ce_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-10-08_5da028523e374dfe218da9c3cc32a8ce_cobalt-strike_icedid_njrat_satacom_stealc
Size 222KB
Sample261009-q3p47sys3m
SHA256 00ddb767095fe445df427957d5a66297e1cf90565b9fe146f6a8f0bd78aa2f37
MD5 5da028523e374dfe218da9c3cc32a8ce
SHA1 946fec4c298ea2df6b07640538cda3e14608b360
SHA512 9b3f92d7300039d890d87f5a751dc43fc692caeb8f2d9332dd3a6c28087df724c16eaddd7485cd6fdc82488bb0efb28cd2c96da66337477302acf644277ea4b7
SSDEEP 3072:mH2TZjzGEn+eCJtFD/eD2NxurH4/D+Z8e96NZfQf2vwnvXxP1:mH2TZjzGEnkFCDcxuD4L+C+1
TLSH
T1C8247D18F7A548FAE6678539C9528501DA727C4247A0EACF07904AF7DF27BD04E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-08_5da028523e374dfe218da9c3cc32a8ce_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-08_5da028523e374dfe218da9c3cc32a8ce_cobalt-strike_icedid_njrat_satacom_stealc

.exe 222KB

2026-10-08_5da028523e374dfe218da9c3cc32a8ce_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 0bc6a1b0c67c9b9080a643258cc28808
SHA256 00ddb767095fe445df427957d5a66297e1cf90565b9fe146f6a8f0bd78aa2f37
MD5 5da028523e374dfe218da9c3cc32a8ce
SHA1 946fec4c298ea2df6b07640538cda3e14608b360
SHA512 9b3f92d7300039d890d87f5a751dc43fc692caeb8f2d9332dd3a6c28087df724c16eaddd7485cd6fdc82488bb0efb28cd2c96da66337477302acf644277ea4b7
SSDEEP 3072:mH2TZjzGEn+eCJtFD/eD2NxurH4/D+Z8e96NZfQf2vwnvXxP1:mH2TZjzGEnkFCDcxuD4L+C+1
TLSH
T1C8247D18F7A548FAE6678539C9528501DA727C4247A0EACF07904AF7DF27BD04E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

22320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoTaskMemFree

shell32

SHGetKnownFolderPath

kernel32

FlsSetValue WriteConsoleW ReadConsoleW ReadFile DeleteFileW CloseHandle WaitForSingleObject CreateProcessW GetLocalTime MoveFileW MoveFileExW LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW SetEndOfFile RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetCPInfo IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType GetStringTypeW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetProcessHeap CreateFileW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc

Name

.text

Size

143KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-08_5da028523e374dfe218da9c3cc32a8ce_cobalt-strike_icedid_njrat_satacom_stealc

ole32

shell32

kernel32

generic