2026-10-10_99345b33585820b71bf890f63cf47bc8_cobalt-strike_icedid_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_99345b33585820b71bf890f63cf47bc8_cobalt-strike_icedid_satacom_stealc
Size 1.4MB
Sample261011-jk35saec76
SHA256 20e26fd04664ddb25d86f03b35f284c232aeb77c95168dfddbab2c34468c33b4
MD5 99345b33585820b71bf890f63cf47bc8
SHA1 921144edc7b3262d531adfa95c007dd45d6ebfb9
SHA512 7dacb1bd6a1eccecd3368349b0569c42772ae7cd95679cbc2036955d643e848a79cd056029f211603f3a6ff19f7084366b22661d52acfaabe2a8ad8dda561abe
SSDEEP 24576:vM6h0lhSMXl/Kekp69dx4BMD3PAQ7J0nDA7FKyXZtx8vdlFI4IcDZ74yXZtQ:vktkg9d+dQ7J0DF6AvhI8Z746a
TLSH
T19B650212F7E591FDE267C27888660B05EA337C450762ABDF1358A5A61F236C09E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_99345b33585820b71bf890f63cf47bc8_cobalt-strike_icedid_satacom_stealc

File Explorer

2026-10-10_99345b33585820b71bf890f63cf47bc8_cobalt-strike_icedid_satacom_stealc

.exe 1.4MB

2026-10-10_99345b33585820b71bf890f63cf47bc8_cobalt-strike_icedid_satacom_stealc

IMPHASH 44233203456a50a7458a2fe0caa6dc67
SHA256 20e26fd04664ddb25d86f03b35f284c232aeb77c95168dfddbab2c34468c33b4
MD5 99345b33585820b71bf890f63cf47bc8
SHA1 921144edc7b3262d531adfa95c007dd45d6ebfb9
SHA512 7dacb1bd6a1eccecd3368349b0569c42772ae7cd95679cbc2036955d643e848a79cd056029f211603f3a6ff19f7084366b22661d52acfaabe2a8ad8dda561abe
SSDEEP 24576:vM6h0lhSMXl/Kekp69dx4BMD3PAQ7J0nDA7FKyXZtx8vdlFI4IcDZ74yXZtQ:vktkg9d+dQ7J0DF6AvhI8Z746a
TLSH
T19B650212F7E591FDE267C27888660B05EA337C450762ABDF1358A5A61F236C09E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

91104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Code\Infologika\Suporte Infologika\Ver 2_7cpp\bin\x64\Release\instalaSuporte.pdb

kernel32

CreateFileW OpenProcess SetFileAttributesW CreateToolhelp32Snapshot Process32NextW DeleteFileW Process32FirstW CopyFileW WideCharToMultiByte ReadFile GetFileSizeEx LoadLibraryW GetProcAddress SetFilePointerEx WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapSize GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindFirstFileExW WaitForSingleObject GetFileType FindClose GetTempPathW RemoveDirectoryW TerminateProcess WriteFile FindNextFileW WritePrivateProfileStringW FindFirstFileW CreateDirectoryW LocalFree CloseHandle GetLastError Sleep CreateMutexW GetModuleFileNameW GetCurrentProcess HeapReAlloc GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapAlloc GetModuleHandleExW FreeLibrary ExitProcess GetStdHandle IsProcessorFeaturePresent FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineW MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError

user32

DispatchMessageW ShowWindow SetWindowTextW GetSystemMetrics SendMessageW PeekMessageW MessageBoxW DestroyWindow DefWindowProcW LoadIconW PostQuitMessage UpdateWindow CreateWindowExW TranslateMessage RegisterClassW

advapi32

StartServiceW OpenProcessToken CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW DeleteService ControlService GetTokenInformation OpenServiceW RegCloseKey RegCreateKeyExW RegSetValueExW

ole32

CoInitializeEx CoCreateInstance CoUninitialize

shell32

ShellExecuteW CommandLineToArgvW SHGetFolderPathW ShellExecuteExW

comctl32

InitCommonControlsEx

Name

.text

Size

177KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

215KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_99345b33585820b71bf890f63cf47bc8_cobalt-strike_icedid_satacom_stealc

kernel32

user32

advapi32

ole32

shell32

comctl32

generic