2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc
Size 4.5MB
Sample261022-sebysads5w
SHA256 7c83388493e6d72ab3c7e360e41d0dcd6d42fb97b92d09ed96454abfa7884b17
MD5 a1f66ce9cde30ccf2183367055698754
SHA1 c9a24a52107c9e8e064fb2fbf4a2337727587514
SHA512 9a7f67ab1cc10d41448114096505cbb6165a5476637c796a94d13d683d488a1ebdfb5e24dd56b5917e4fb26dcc50eb86e760d78ab07f34b40bce4b6c4dd84a25
SSDEEP 49152:ycCWQ71vJ8xz8xUVZJJY7Uy8E1TvJ4zF:tkkoxwy7Uy8CvJK
TLSH
T1D726E04799A602EAC8B9D179C5562A22F9A170894370BFDB72EC45E31B777E04F3D302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc

.exe 4.5MB

2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 1a38cf6e0378ff3518c1b39586502e85
SHA256 7c83388493e6d72ab3c7e360e41d0dcd6d42fb97b92d09ed96454abfa7884b17
MD5 a1f66ce9cde30ccf2183367055698754
SHA1 c9a24a52107c9e8e064fb2fbf4a2337727587514
SHA512 9a7f67ab1cc10d41448114096505cbb6165a5476637c796a94d13d683d488a1ebdfb5e24dd56b5917e4fb26dcc50eb86e760d78ab07f34b40bce4b6c4dd84a25
SSDEEP 49152:ycCWQ71vJ8xz8xUVZJJY7Uy8E1TvJ4zF:tkkoxwy7Uy8CvJK
TLSH
T1D726E04799A602EAC8B9D179C5562A22F9A170894370BFDB72EC45E31B777E04F3D302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

377584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

TerminateProcess CreateProcessW OpenProcess GetSystemTimeAsFileTime GetTickCount64 GetModuleFileNameW QueryFullProcessImageNameW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileAttributesW SetLastError OpenMutexW GetEnvironmentVariableW CreateDirectoryW DeleteFileW GetVolumeInformationW GetTickCount CopyFileW lstrlenW SwitchToThread GetSystemDirectoryW SetEnvironmentVariableA SetFileAttributesW CreateThread VirtualAlloc VirtualFree GetModuleHandleW GetProcAddress FindClose GetCurrentProcessId FindNextFileW IsDebuggerPresent CheckRemoteDebuggerPresent SetErrorMode QueryPerformanceFrequency InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentProcess GetCurrentThread GetCurrentThreadId OpenThread SuspendThread ResumeThread GlobalMemoryStatusEx GetSystemInfo VirtualQuery GetConsoleWindow Thread32First Thread32Next GetEnvironmentVariableA ExitProcess FreeLibrary IsProcessorFeaturePresent lstrlenA GetACP GetOEMCP WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateMutexW Sleep WaitForSingleObject GetCommandLineW QueryPerformanceCounter GetLastError CloseHandle GetTempPathW WriteFile CreateFileW FindFirstFileW FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetStringTypeW SetStdHandle ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeCriticalSectionEx DeleteCriticalSection GetModuleHandleExW GetStdHandle RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapFree HeapAlloc GetFileType FindFirstFileExW IsValidCodePage GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap

user32

ShowWindow GetSystemMetrics wsprintfA

gdi32

GetStockObject

advapi32

RegQueryValueExA RegOpenKeyExA GetUserNameW RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCloseKey RegCreateKeyExW

shell32

SHGetFolderPathW ShellExecuteW

dwmapi

DwmIsCompositionEnabled

version

GetFileVersionInfoSizeW

shlwapi

PathIsDirectoryW

Name

.text

Size

471KB

Virtual Size

471KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_a1f66ce9cde30ccf2183367055698754_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

dwmapi

version

shlwapi

generic