2026-10-22_e81bb8aefcc7355f1552d73d2608af39_cobalt-strike_icedid_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_e81bb8aefcc7355f1552d73d2608af39_cobalt-strike_icedid_satacom
Size 1.5MB
Sample261023-e9m3mszw4n
SHA256 315433446690278f0bc1afcf44bacdd6bf3d08e4e4ac7ee1b428cad5de22e0ec
MD5 e81bb8aefcc7355f1552d73d2608af39
SHA1 3f5a569cba487d1660f54ac65224cbbe07b554db
SHA512 2f78afd6692b9462c95861b01edabd39d18691a83fe76f970c8884fd870352ffeebe4d24b66d2b4b9a0031bd9b7d863057c0acf0a1b05dc201d6e3cd5f0547c1
SSDEEP 24576:umbXhZ18ytbW3LIXGhuqYYJL01b7ZR+YOUWj7yrtW:XhztkIetJNBU
TLSH
T1B665E1EBEA5B7EC5C433C53444266818E6917C310926CB9EDE631A17CC2A7C2AF35E35
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_e81bb8aefcc7355f1552d73d2608af39_cobalt-strike_icedid_satacom

File Explorer

2026-10-22_e81bb8aefcc7355f1552d73d2608af39_cobalt-strike_icedid_satacom

.exe 1.5MB

2026-10-22_e81bb8aefcc7355f1552d73d2608af39_cobalt-strike_icedid_satacom

IMPHASH 5633dbf8a4c722f357fd9344504f3608
SHA256 315433446690278f0bc1afcf44bacdd6bf3d08e4e4ac7ee1b428cad5de22e0ec
MD5 e81bb8aefcc7355f1552d73d2608af39
SHA1 3f5a569cba487d1660f54ac65224cbbe07b554db
SHA512 2f78afd6692b9462c95861b01edabd39d18691a83fe76f970c8884fd870352ffeebe4d24b66d2b4b9a0031bd9b7d863057c0acf0a1b05dc201d6e3cd5f0547c1
SSDEEP 24576:umbXhZ18ytbW3LIXGhuqYYJL01b7ZR+YOUWj7yrtW:XhztkIetJNBU
TLSH
T1B665E1EBEA5B7EC5C433C53444266818E6917C310926CB9EDE631A17CC2A7C2AF35E35
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCreateKeyExW RegSetValueExW CloseServiceHandle ControlService OpenSCManagerW OpenServiceW RegCloseKey

kernel32

CreateFileW DeleteFileW WriteFile GetTempPathW CloseHandle HeapAlloc HeapFree GetProcessHeap WaitForSingleObject Sleep GetCurrentProcessId ExitProcess CreateThread CreateProcessW GetTickCount WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize LCMapStringW LoadLibraryExW VirtualProtect QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW GetCurrentProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW

user32

wsprintfW PostMessageW SetWindowTextW

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket

oleaut32

SafeArrayCreateVector SafeArrayPutElement SysFreeString SysAllocStringLen VariantInit VariantClear

Name

.text

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_e81bb8aefcc7355f1552d73d2608af39_cobalt-strike_icedid_satacom

advapi32

kernel32

user32

ole32

oleaut32

generic