2026-10-11_496d3897f266dff738f51867759a7690_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_496d3897f266dff738f51867759a7690_cobalt-strike_icedid_njrat_satacom_stealc
Size 514KB
Sample261012-2gvcksf171
SHA256 c1921aaaa52c28beba72eb573da25c86af6302748ad96dcc215e0fec23e8d29a
MD5 496d3897f266dff738f51867759a7690
SHA1 b56c84185ca3290ddf84a280c65da1b88f212358
SHA512 662550fd773320955a34f2f04712e45438342aafdfbb205e1f71474fc06d37a04688d427d6ba2bf3cf6645ea46b205e5cfafaecdeb619a69e6ec0b1cfd7e38a3
SSDEEP 6144:txKJMxTNN8/VQJfYzqzlSZW9POysLrNvubnGWzdGoDyTri/Tyzu73HuCKTLrZg+M:eQ31zYAJsLrNvubGNa2arudHr++IVZ3
TLSH
T1D3B46C55A69807FCE177D2B8C9534902FA72B8864330AECF03905AB21F276E55E3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_496d3897f266dff738f51867759a7690_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-11_496d3897f266dff738f51867759a7690_cobalt-strike_icedid_njrat_satacom_stealc

.exe 514KB

2026-10-11_496d3897f266dff738f51867759a7690_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 1b7236498dc84f6e59020407ef8e8e5c
SHA256 c1921aaaa52c28beba72eb573da25c86af6302748ad96dcc215e0fec23e8d29a
MD5 496d3897f266dff738f51867759a7690
SHA1 b56c84185ca3290ddf84a280c65da1b88f212358
SHA512 662550fd773320955a34f2f04712e45438342aafdfbb205e1f71474fc06d37a04688d427d6ba2bf3cf6645ea46b205e5cfafaecdeb619a69e6ec0b1cfd7e38a3
SSDEEP 6144:txKJMxTNN8/VQJfYzqzlSZW9POysLrNvubnGWzdGoDyTri/Tyzu73HuCKTLrZg+M:eQ31zYAJsLrNvubGNa2arudHr++IVZ3
TLSH
T1D3B46C55A69807FCE177D2B8C9534902FA72B8864330AECF03905AB21F276E55E3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

218016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpOpen

ole32

CoTaskMemFree CoInitializeEx CoUninitialize CreateStreamOnHGlobal

gdiplus

GdiplusStartup GdipCloneImage GdipSaveImageToStream GdipCreateBitmapFromHBITMAP GdipFree GdiplusShutdown GdipAlloc GdipDisposeImage

mfplat

MFStartup MFShutdown MFCreateAttributes MFCreateMediaType

mfreadwrite

MFCreateSourceReaderFromMediaSource

mf

MFEnumDeviceSources

user32

TranslateMessage DispatchMessageA PeekMessageA ExitWindowsEx ShowWindow OpenClipboard CloseClipboard GetClipboardData LockWorkStation SystemParametersInfoW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA MessageBoxW ReleaseDC GetDC GetSystemMetrics

gdi32

DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt SelectObject

advapi32

RegSetValueExW RegSetValueExA RegOpenKeyExW RegCreateKeyExA RegCloseKey GetUserNameW LookupPrivilegeValueA FreeSid CheckTokenMembership AllocateAndInitializeSid AdjustTokenPrivileges OpenProcessToken

ws2_32

select closesocket inet_addr socket htons ioctlsocket connect

winmm

waveInUnprepareHeader waveInAddBuffer waveInStart waveInStop waveInPrepareHeader waveInClose waveInOpen

powrprof

SetSuspendState

kernel32

FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect ReadConsoleW PeekConsoleInputA GetConsoleOutputCP GetNumberOfConsoleInputEvents SetConsoleMode GetConsoleMode CreateFileW GetExitCodeProcess HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle IsProcessorFeaturePresent SetFilePointerEx IsValidCodePage GetACP GetOEMCP HeapReAlloc GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW SetEndOfFile ReadConsoleInputW FormatMessageA GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread GetConsoleCP FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader GetEnvironmentStrings FreeEnvironmentStringsA GetCurrentDirectoryA CreateDirectoryA CreateFileA GetDiskFreeSpaceExA GetFileSizeEx ReadFile GetTempPathW GetTempPathA GetVolumeInformationA Beep CloseHandle SetHandleInformation CreatePipe WaitForSingleObject Sleep GetCurrentProcess ExitProcess TerminateProcess CreateProcessA CreateProcessW OpenProcess GetTickCount GetTickCount64 GetVersionExW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetProcAddress GlobalUnlock GlobalLock GetLogicalDriveStringsA CopyFileW GetComputerNameA GetComputerNameW GetSystemPowerStatus WideCharToMultiByte GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW LocalFree RtlUnwind GetLocaleInfoEx QueryPerformanceCounter QueryPerformanceFrequency GetLastError GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive MultiByteToWideChar GetStringTypeW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 AreFileApisANSI DeviceIoControl GetModuleHandleW CopyFile2 MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx GetCPInfo GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW

Name

.text

Size

373KB

Virtual Size

373KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_496d3897f266dff738f51867759a7690_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

ole32

gdiplus

mfplat

mfreadwrite

mf

user32

gdi32

advapi32

ws2_32

winmm

powrprof

kernel32

generic