2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom
Size 1.5MB
Sample261020-16pyqaaw7k
SHA256 5fb5108a71873fa2e0a6d40456f40ab55b31b2ebf61122a3e45793971f0bfe77
MD5 431350050f4d4c5ed7d1fa899750adb1
SHA1 fb76121e9267a44e7ad011a636b7796f03bb8770
SHA512 4fa76bac8fa53591006ba436337316052d091fa2f21e6836951f97fc904f5f6a2bb81698288152bc7f696e29acb99707b1fa2dd431bf4186ac89bf2168e7b73d
SSDEEP 24576:N+twzlO9VkYzbOeZz38oT9dyvca5CJlTBs4zt6ap733k8:YCzlSVkY+0zFvZXlTBs4zgE7
TLSH
T170750816B76965D9C07BC078C2878E62A93130DA0B397EFB45D192792F25EF86E3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom

File Explorer

2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom

.exe 1.5MB

2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom

IMPHASH 101363093dfab6c923b63621bb202cb8
SHA256 5fb5108a71873fa2e0a6d40456f40ab55b31b2ebf61122a3e45793971f0bfe77
MD5 431350050f4d4c5ed7d1fa899750adb1
SHA1 fb76121e9267a44e7ad011a636b7796f03bb8770
SHA512 4fa76bac8fa53591006ba436337316052d091fa2f21e6836951f97fc904f5f6a2bb81698288152bc7f696e29acb99707b1fa2dd431bf4186ac89bf2168e7b73d
SSDEEP 24576:N+twzlO9VkYzbOeZz38oT9dyvca5CJlTBs4zt6ap733k8:YCzlSVkY+0zFvZXlTBs4zgE7
TLSH
T170750816B76965D9C07BC078C2878E62A93130DA0B397EFB45D192792F25EF86E3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1097632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

peer_death-46ca4946d67e3ea7.pdb

ntdll

NtCreateNamedPipeFile NtOpenFile NtWriteFile RtlNtStatusToDosError NtReadFile NtClose NtCreateWaitCompletionPacket NtCancelWaitCompletionPacket NtRemoveIoCompletionEx NtSetIoCompletion NtCreateIoCompletion NtAssociateWaitCompletionPacket RtlAddMandatoryAce RtlAddAccessAllowedAce RtlCreateAcl RtlLengthSid NtQueryInformationToken NtOpenProcessToken RtlValidRelativeSecurityDescriptor RtlSetSaclSecurityDescriptor RtlSetDaclSecurityDescriptor RtlCreateSecurityDescriptor NtCreateMutant NtOpenEvent NtWaitForMultipleObjects NtQueryInformationProcess NtOpenProcess NtOpenSection NtQuerySection NtCreateSection NtMapViewOfSection NtResetEvent NtWaitForSingleObject NtSetEvent NtCreateEvent NtQueryEvent NtUnmapViewOfSection NtReleaseMutant

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

WaitForSingleObjectEx HeapSize LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA FreeLibrary WriteFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsGetValue RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime FindNextFileW SetStdHandle QueryPerformanceFrequency CloseHandle GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW GetCurrentProcess DuplicateHandle GetProcessHeap HeapFree HeapReAlloc QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx SleepEx WriteFileEx ReadFile GetOverlappedResult FlushFileBuffers RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetProcessId TerminateProcess GetEnvironmentStringsW GetExitCodeProcess SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread GetProcAddress WideCharToMultiByte LoadLibraryA CreateMutexA ReleaseMutex GetEnvironmentVariableW SetEnvironmentVariableW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetFileAttributesW FlsFree FlsAlloc GetModuleHandleExW GetModuleHandleW IsThreadAFiber FlsSetValue GetFileType FormatMessageW WaitForMultipleObjects GetModuleHandleA

userenv

GetUserProfileDirectoryW

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

332KB

Virtual Size

332KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_431350050f4d4c5ed7d1fa899750adb1_cobalt-strike_icedid_satacom

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

userenv

generic