2026-10-17_96f48e54bb0d568375aa463def836d8a_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-17_96f48e54bb0d568375aa463def836d8a_cobalt-strike_icedid_njrat_satacom_stealc
Size 2.0MB
Sample261018-3nhsssbz21
SHA256 1efb2c2836ec3a0f5f66f37c0435e02ae5c1f1a51620513533751dd37d558b2a
MD5 96f48e54bb0d568375aa463def836d8a
SHA1 72c608ee2824b6bc8bd02dfc03e893f68af0fde7
SHA512 e7e48374272b375dc707a7b4cbceda56f2e635ecbc2accb03a31e0481252f69f71a921f6d606926a2e7397605c369561ddf9c1b044bd8bbeb8ba2f069487bd77
SSDEEP 24576:u/XYAn+AC8jhZaOeFwydx6txptCFu8dEBDpRR6d4pHMupkK1eWf4av:u/IA+AxWC
TLSH
T14CA56CB6AF609DD1C68F56B18CB55D8C1EEA27324249A1CEC1A706820D177F7DE1E83C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

revoked_codesign

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
2026-10-17_96f48e54bb0d568375aa463def836d8a_cobalt-strike_icedid_njrat_satacom_stealc

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-17_96f48e54bb0d568375aa463def836d8a_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-17_96f48e54bb0d568375aa463def836d8a_cobalt-strike_icedid_njrat_satacom_stealc

.exe 2.0MB

2026-10-17_96f48e54bb0d568375aa463def836d8a_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 77feb9d1d34c7ca34c0d10e5a010f11a
SHA256 1efb2c2836ec3a0f5f66f37c0435e02ae5c1f1a51620513533751dd37d558b2a
MD5 96f48e54bb0d568375aa463def836d8a
SHA1 72c608ee2824b6bc8bd02dfc03e893f68af0fde7
SHA512 e7e48374272b375dc707a7b4cbceda56f2e635ecbc2accb03a31e0481252f69f71a921f6d606926a2e7397605c369561ddf9c1b044bd8bbeb8ba2f069487bd77
SSDEEP 24576:u/XYAn+AC8jhZaOeFwydx6txptCFu8dEBDpRR6d4pHMupkK1eWf4av:u/IA+AxWC
TLSH
T14CA56CB6AF609DD1C68F56B18CB55D8C1EEA27324249A1CEC1A706820D177F7DE1E83C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b5:68:bc:cc:e2:5e:fe:30:0b:de:6e:6e:ab:c1:08:14:05:bf:35:61

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nanjing Zhixiao Information Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Nanjing Zhixiao Information Technology Co.\,Ltd,L=Nanjing,ST=Jiangsu,C=CN

Chains

Oct 15, 2026

CN=Nanjing Zhixiao Information Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Nanjing Zhixiao Information Technology Co.\,Ltd,L=Nanjing,ST=Jiangsu,C=CN

PE Signature issue

Digest

b5:68:bc:cc:e2:5e:fe:30:0b:de:6e:6e:ab:c1:08:14:05:bf:35:61

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MEDIATEK INC.,O=MEDIATEK INC.,L=HSINCHU,ST=TAIWAN,C=TW

Chains

Oct 15, 2026

CN=MEDIATEK INC.,O=MEDIATEK INC.,L=HSINCHU,ST=TAIWAN,C=TW

Subject

CN=MEDIATEK INC.,O=MEDIATEK INC.,L=HSINCHU,ST=TAIWAN,C=TW

Serial Number

56:f0:08:e6:9a:7c:4c:3f:eb:38:9c:66:ea:f5:82:59

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Aug 24, 2015

Timespan

May 26, 2014 - Jun 24, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Nanjing Zhixiao Information Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Nanjing Zhixiao Information Technology Co.\,Ltd,L=Nanjing,ST=Jiangsu,C=CN

Serial Number

20:e6:5f:5d:29:b5:82:24:10:50:4b:1a:c1:83:ca:3d

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 14, 2013 - Nov 14, 2014

Minor OS version

Major OS version

Entry point

127632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptGenRandom BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty BCryptOpenAlgorithmProvider BCryptCreateHash

shell32

ShellExecuteExW SHGetFolderPathW

advapi32

OpenServiceW RegCreateKeyExA LookupPrivilegeValueW RevertToSelf QueryServiceStatusEx ChangeServiceConfig2W ChangeServiceConfigW RegQueryValueExW RegEnumKeyExW RegSaveKeyExW RegDeleteTreeA RegUnLoadKeyW RegSetValueExA RegRestoreKeyW RegOpenKeyExW RegLoadKeyW AllocateAndInitializeSid CheckTokenMembership FreeSid RegCloseKey RegCreateKeyExW RegFlushKey RegSetValueExW CloseServiceHandle ControlService CreateServiceW OpenSCManagerW DuplicateTokenEx QueryServiceStatus StartServiceW CreateProcessAsUserW SetThreadToken OpenProcessToken AdjustTokenPrivileges RegDeleteKeyA

fltlib

FilterSendMessage FilterConnectCommunicationPort

kernel32

GetConsoleOutputCP GetConsoleMode FindFirstFileExW WriteConsoleW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW Process32FirstW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx GetFullPathNameW ReadFile WriteFile CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap WaitForSingleObject Sleep GetCurrentProcess GetExitCodeProcess CreateProcessW GetWindowsDirectoryW Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection IsWow64Process GetModuleFileNameW GetModuleHandleA GetProcAddress LoadLibraryA CopyFileW CreateToolhelp32Snapshot FlushFileBuffers Process32NextW GetCurrentProcessId TerminateProcess OpenProcess GetSystemDirectoryW GetModuleHandleW LoadLibraryW WideCharToMultiByte GetTickCount64 QueryFullProcessImageNameW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetFileType HeapReAlloc HeapSize SetFilePointerEx GetStringTypeW SetStdHandle RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer ExitProcess FreeLibrary GetModuleHandleExW GetStdHandle IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter VirtualProtect LoadLibraryExW LCMapStringW

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RtlVirtualUnwind

Name

.text

Size

218KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

283KB

Virtual Size

338KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-17_96f48e54bb0d568375aa463def836d8a_cobalt-strike_icedid_njrat_satacom_stealc

PE Signature issue

PE Signature issue

bcrypt

shell32

advapi32

fltlib

kernel32

ntdll

generic