2026-10-18_579053590ce42f33613b87a1e0ed629d_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-10-18_579053590ce42f33613b87a1e0ed629d_cobalt-strike_icedid_njrat_satacom_stealc
Size 3.6MB
Sample261018-rlt79sys6r
SHA256 aaaf69e4e0b4a182534ba40660b6bba498157a21b2f879b0c927f0932029c379
MD5 579053590ce42f33613b87a1e0ed629d
SHA1 ab83c8176ecd42d30df3c9524557899d28eb83b4
SHA512 e02f6b6fdb3101f932119c32bc4eae6a30540514773a8c89f1c8b4b9521469c73f321e1e52b36ff286b6171b603452579cca32c8dce475ec04cd218f2f37db58
SSDEEP 98304:3HmdqkbvqgHsf5fPauI03eLE4gEwEvMzb/rNj:3mIk1MfxPaI3eLE4gELMzb/rV
TLSH
T12E061247969A12F6D876D134C8162A22FCA2349D43B07FEF16E805D71B776E09B3E342
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-18_579053590ce42f33613b87a1e0ed629d_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-18_579053590ce42f33613b87a1e0ed629d_cobalt-strike_icedid_njrat_satacom_stealc

.exe 3.6MB

2026-10-18_579053590ce42f33613b87a1e0ed629d_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 0e1ed17ce23e2678ab392575953c98b2
SHA256 aaaf69e4e0b4a182534ba40660b6bba498157a21b2f879b0c927f0932029c379
MD5 579053590ce42f33613b87a1e0ed629d
SHA1 ab83c8176ecd42d30df3c9524557899d28eb83b4
SHA512 e02f6b6fdb3101f932119c32bc4eae6a30540514773a8c89f1c8b4b9521469c73f321e1e52b36ff286b6171b603452579cca32c8dce475ec04cd218f2f37db58
SSDEEP 98304:3HmdqkbvqgHsf5fPauI03eLE4gEwEvMzb/rNj:3mIk1MfxPaI3eLE4gELMzb/rV
TLSH
T12E061247969A12F6D876D134C8162A22FCA2349D43B07FEF16E805D71B776E09B3E342
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

383408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Sleep GetCurrentProcessId TerminateProcess CreateProcessW OpenProcess GetSystemTimeAsFileTime GetTickCount64 GetModuleFileNameW GetModuleHandleW GetProcAddress QueryFullProcessImageNameW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileAttributesW SetLastError OpenMutexW GetEnvironmentVariableW CreateDirectoryW DeleteFileW GetVolumeInformationW GetTickCount CopyFileW SwitchToThread GetSystemDirectoryW SetEnvironmentVariableA SetFileAttributesW FindClose FindFirstFileW FindNextFileW CreateMutexW CheckRemoteDebuggerPresent SetErrorMode QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentProcess CreateThread GetCurrentThread GetCurrentThreadId OpenThread SuspendThread ResumeThread GlobalMemoryStatusEx GetSystemInfo VirtualQuery GetConsoleWindow Thread32First Thread32Next GetEnvironmentVariableA ExitProcess LoadLibraryW GetLocaleInfoW IsProcessorFeaturePresent lstrlenA GetACP GetOEMCP WriteConsoleW GetConsoleMode WaitForSingleObject QueryPerformanceCounter GetLastError CloseHandle GetTempPathW WriteFile CreateFileW IsDebuggerPresent GetCommandLineW GetConsoleOutputCP FlushFileBuffers ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx DeleteCriticalSection FreeLibrary GetModuleHandleExW GetStdHandle RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapFree HeapAlloc GetFileType FindFirstFileExW IsValidCodePage GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap SetStdHandle GetStringTypeW SetFilePointerEx HeapSize HeapReAlloc

user32

wsprintfA ShowWindow GetSystemMetrics

advapi32

RegOpenKeyExA GetUserNameW RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey RegQueryValueExA

shell32

SHGetFolderPathW

Name

.text

Size

476KB

Virtual Size

475KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-18_579053590ce42f33613b87a1e0ed629d_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

generic