2026-10-10_04c6b844ce8756267364a5a714cd4418_cobalt-strike_icedid_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_04c6b844ce8756267364a5a714cd4418_cobalt-strike_icedid_satacom_stealc
Size 483KB
Sample261011-2fw5saac39
SHA256 6b2f31d3ea680cc237fd5a34f09abe7bc0d9cf2b25a0e7d30cf6d1280b152c0e
MD5 04c6b844ce8756267364a5a714cd4418
SHA1 a367a08cae0c3aabc337f6a3818e88b06c8a9ca4
SHA512 463322982809a4682f390886aa90643ca2ef0eb44df6aaf7ccb1f251a2c50d064b97f9c55295d7f2ec702785141e87b7a97ce950d3d2425ab11f3715c09645cd
SSDEEP 6144:iBqO/r9aVA+eVT2YF36ksc7keXyECQPS4EPWuKutuG:iBqOx63myzJc7R99SHPWvG
TLSH
T188B4F84EEAB511F1D4BAC03CC682651FFC7134A68370A7CB57919A671B23BE4A93E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_04c6b844ce8756267364a5a714cd4418_cobalt-strike_icedid_satacom_stealc

File Explorer

2026-10-10_04c6b844ce8756267364a5a714cd4418_cobalt-strike_icedid_satacom_stealc

.exe 483KB

2026-10-10_04c6b844ce8756267364a5a714cd4418_cobalt-strike_icedid_satacom_stealc

IMPHASH d04d82cd6dbed9ab1695a70825d6142d
SHA256 6b2f31d3ea680cc237fd5a34f09abe7bc0d9cf2b25a0e7d30cf6d1280b152c0e
MD5 04c6b844ce8756267364a5a714cd4418
SHA1 a367a08cae0c3aabc337f6a3818e88b06c8a9ca4
SHA512 463322982809a4682f390886aa90643ca2ef0eb44df6aaf7ccb1f251a2c50d064b97f9c55295d7f2ec702785141e87b7a97ce950d3d2425ab11f3715c09645cd
SSDEEP 6144:iBqO/r9aVA+eVT2YF36ksc7keXyECQPS4EPWuKutuG:iBqOx63myzJc7R99SHPWvG
TLSH
T188B4F84EEAB511F1D4BAC03CC682651FFC7134A68370A7CB57919A671B23BE4A93E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

217008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

closesocket connect ioctlsocket getsockopt __WSAFDIsSet recv select send setsockopt shutdown socket WSAStartup WSACleanup WSAGetLastError getaddrinfo inet_pton freeaddrinfo

gdiplus

GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipSaveImageToStream GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipGetImageEncoders

gdi32

SetBrushOrgEx SetStretchBltMode StretchBlt SelectObject DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap

ole32

GetHGlobalFromStream CreateStreamOnHGlobal

user32

TranslateMessage DispatchMessageW PostThreadMessageW SendInput GetSystemMetrics GetDC ReleaseDC SetWindowsHookExW UnhookWindowsHookEx EnumDisplayMonitors CallNextHookEx GetMessageW

advapi32

RegSetValueExW RegCreateKeyExW RegCloseKey

winhttp

WinHttpConnect WinHttpReadData WinHttpOpen WinHttpSendRequest WinHttpReceiveResponse WinHttpOpenRequest WinHttpCloseHandle

shell32

ShellExecuteW

kernel32

IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetOEMCP HeapReAlloc GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap GetACP GetDateFormatW LoadLibraryExW VirtualProtect HeapAlloc HeapFree GetTimeZoneInformation UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext ExitProcess GetCurrentProcess WriteFile GetStdHandle HeapSize WriteConsoleW SetEndOfFile FindClose IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread GetCommandLineW GetCommandLineA FlsFree CreateFileW ReadFile CloseHandle SetHandleInformation CreatePipe WaitForSingleObject TerminateProcess GetExitCodeProcess GetCurrentThreadId CreateProcessA GetModuleFileNameA GetModuleFileNameW GetModuleHandleW GlobalSize GlobalUnlock GlobalLock FormatMessageA FreeConsole GetConsoleWindow QueryPerformanceCounter QueryPerformanceFrequency GetLastError WaitForSingleObjectEx Sleep GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive LocalFree GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW RtlUnwind FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFinalPathNameByHandleW SetFileInformationByHandle GetTempPathW CreateFile2 AreFileApisANSI GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW FlsSetValue RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue

Name

.text

Size

353KB

Virtual Size

352KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_04c6b844ce8756267364a5a714cd4418_cobalt-strike_icedid_satacom_stealc

ws2_32

gdiplus

gdi32

ole32

user32

advapi32

winhttp

shell32

kernel32

generic