2026-10-20_2c85a110fa2b84c881be0923225c8c4a_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-10-20_2c85a110fa2b84c881be0923225c8c4a_cobalt-strike_icedid_njrat_satacom_stealc
Size 3.6MB
Sample261020-j3d9daxvcs
SHA256 03938d1ce90c1bdcbe6ca1ac66e0a28243a82ed9bdc3046724acbcf93b9b4a13
MD5 2c85a110fa2b84c881be0923225c8c4a
SHA1 8c25309ab65f5801c5cc112eef5740f03f91b9ed
SHA512 704380b6e3c89a835b0b6561c4cf2b2e046dc27ce39af45b84bf540da575acf5781e29554bca243b4a9bf2ca04d40537b9338dfdb277df21b0e5b0a9acd14644
SSDEEP 98304:dOd19TunsWq7F75gVrjBZYJdiKgrO7IZhDGAXR9y:YnynsW6F75agdiK0O7IZhDnC
TLSH
T17D061247969516EAC8BA8438C84B6623F8A234CD43B47FDB16E805D72B777E05B7D302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-20_2c85a110fa2b84c881be0923225c8c4a_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-20_2c85a110fa2b84c881be0923225c8c4a_cobalt-strike_icedid_njrat_satacom_stealc

.exe 3.6MB

2026-10-20_2c85a110fa2b84c881be0923225c8c4a_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 0e1ed17ce23e2678ab392575953c98b2
SHA256 03938d1ce90c1bdcbe6ca1ac66e0a28243a82ed9bdc3046724acbcf93b9b4a13
MD5 2c85a110fa2b84c881be0923225c8c4a
SHA1 8c25309ab65f5801c5cc112eef5740f03f91b9ed
SHA512 704380b6e3c89a835b0b6561c4cf2b2e046dc27ce39af45b84bf540da575acf5781e29554bca243b4a9bf2ca04d40537b9338dfdb277df21b0e5b0a9acd14644
SSDEEP 98304:dOd19TunsWq7F75gVrjBZYJdiKgrO7IZhDGAXR9y:YnynsW6F75agdiK0O7IZhDnC
TLSH
T17D061247969516EAC8BA8438C84B6623F8A234CD43B47FDB16E805D72B777E05B7D302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

380672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Sleep GetCurrentProcessId TerminateProcess CreateProcessW OpenProcess GetSystemTimeAsFileTime GetTickCount64 GetModuleFileNameW GetModuleHandleW GetProcAddress QueryFullProcessImageNameW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileAttributesW SetLastError OpenMutexW GetEnvironmentVariableW CreateDirectoryW DeleteFileW GetVolumeInformationW GetTickCount CopyFileW SwitchToThread GetSystemDirectoryW SetEnvironmentVariableA SetFileAttributesW FindClose FindFirstFileW FindNextFileW CreateMutexW CheckRemoteDebuggerPresent SetErrorMode QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentProcess CreateThread GetCurrentThread GetCurrentThreadId OpenThread SuspendThread ResumeThread GlobalMemoryStatusEx GetSystemInfo VirtualQuery GetConsoleWindow Thread32First Thread32Next GetEnvironmentVariableA ExitProcess LoadLibraryW GetLocaleInfoW IsProcessorFeaturePresent lstrlenA GetACP GetOEMCP WriteConsoleW GetConsoleMode WaitForSingleObject QueryPerformanceCounter GetLastError CloseHandle GetTempPathW WriteFile CreateFileW IsDebuggerPresent GetCommandLineW GetConsoleOutputCP FlushFileBuffers ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx DeleteCriticalSection FreeLibrary GetModuleHandleExW GetStdHandle RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapFree HeapAlloc GetFileType FindFirstFileExW IsValidCodePage GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap SetStdHandle GetStringTypeW SetFilePointerEx HeapSize HeapReAlloc

user32

wsprintfA ShowWindow GetSystemMetrics

advapi32

RegOpenKeyExA GetUserNameW RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey RegQueryValueExA

shell32

SHGetFolderPathW

Name

.text

Size

473KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-20_2c85a110fa2b84c881be0923225c8c4a_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

generic