2026-10-22_e1fc094a69ca3fbfa14852fe2be1d31d_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_e1fc094a69ca3fbfa14852fe2be1d31d_cobalt-strike_icedid_njrat_satacom_stealc
Size 6.6MB
Sample261023-tsb2datt7r
SHA256 8122be1e11085974405c2c1d6284b304de5ebfad3592159a19dd2a1e87cc5505
MD5 e1fc094a69ca3fbfa14852fe2be1d31d
SHA1 5a254c13a4a51d6d483169df61815415ff4888d8
SHA512 f3b15bccc593dd1d848fe6fc873e86fb764c73ca6c23e92bbc4a5d340da3e36c588280eeb142578837f257a6843f1040f3aa3952d2e8677bc7e91fe69cb73754
SSDEEP 49152:52T/3FJWKwXtT8oXGmZOYQYZWUbwEBWlWKaUepqaTJgWwtN9WbFJsReSNPYs5mlv:dxEm6JpLABPqdxEvU5Nk
TLSH
T17A66B006F35C42D8D027987EC66BE302EB717814172943DFE5C14A6B9FAB2E41E3B691
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_e1fc094a69ca3fbfa14852fe2be1d31d_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-22_e1fc094a69ca3fbfa14852fe2be1d31d_cobalt-strike_icedid_njrat_satacom_stealc

.exe 6.6MB

2026-10-22_e1fc094a69ca3fbfa14852fe2be1d31d_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 6761e82682343b045bdb92a17c0d70c4
SHA256 8122be1e11085974405c2c1d6284b304de5ebfad3592159a19dd2a1e87cc5505
MD5 e1fc094a69ca3fbfa14852fe2be1d31d
SHA1 5a254c13a4a51d6d483169df61815415ff4888d8
SHA512 f3b15bccc593dd1d848fe6fc873e86fb764c73ca6c23e92bbc4a5d340da3e36c588280eeb142578837f257a6843f1040f3aa3952d2e8677bc7e91fe69cb73754
SSDEEP 49152:52T/3FJWKwXtT8oXGmZOYQYZWUbwEBWlWKaUepqaTJgWwtN9WbFJsReSNPYs5mlv:dxEm6JpLABPqdxEvU5Nk
TLSH
T17A66B006F35C42D8D027987EC66BE302EB717814172943DFE5C14A6B9FAB2E41E3B691
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2517424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpOpen WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpSetTimeouts

crypt32

CryptUnprotectData

opengl32

wglMakeCurrent glBindTexture glDeleteTextures glEnable glGenTextures glGetError glGetIntegerv glIsEnabled glReadPixels glScissor glTexImage2D glTexParameteri glViewport glColorMask glDisable wglDeleteContext wglGetCurrentContext glDepthMask glGetBooleanv wglGetProcAddress glPixelStorei wglCreateContext glDepthFunc glDrawElements glDrawArrays glCopyTexSubImage2D

ole32

CoInitializeEx CoUninitialize CoTaskMemFree CoCreateInstance

bcrypt

BCryptHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW GetModuleHandleA GetModuleFileNameA FreeLibrary GetProcAddress GetModuleFileNameW GetModuleHandleExA LoadLibraryExW FreeLibraryAndExitThread GetModuleHandleExW

api-ms-win-core-processthreads-l1-1-0

TerminateProcess GetCurrentThreadId ExitThread GetCurrentProcess TlsFree CreateThread OpenThread TlsSetValue TlsGetValue TlsAlloc SuspendThread ExitProcess ResumeThread GetStartupInfoW GetExitCodeThread GetCurrentProcessId

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

SetEvent WaitForSingleObject LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WaitForSingleObjectEx AcquireSRWLockExclusive ReleaseSRWLockExclusive EnterCriticalSection CreateEventW TryAcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW WakeByAddressAll WakeAllConditionVariable Sleep WaitOnAddress

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime GetSystemTimeAsFileTime GetTickCount GetSystemInfo GetTickCount64

api-ms-win-core-errorhandling-l1-1-0

RaiseException SetLastError GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter

api-ms-win-core-file-l1-1-0

CreateFileW GetFileSizeEx SetEndOfFile FindNextFileW FindFirstFileExW GetFileType SetFilePointerEx FindFirstFileW FindClose FlushFileBuffers GetFileAttributesExW WriteFile ReadFile

api-ms-win-core-memory-l1-1-0

VirtualQuery VirtualAlloc VirtualProtect VirtualFree

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte CompareStringW GetStringTypeW

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW SetEnvironmentVariableW GetCommandLineW SetStdHandle GetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineA

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-core-file-l2-1-0

MoveFileExW GetFileInformationByHandleEx

api-ms-win-core-processthreads-l1-1-1

OpenProcess GetThreadContext SetThreadContext FlushInstructionCache IsProcessorFeaturePresent

api-ms-win-core-file-l1-2-0

GetTempPathW CreateFile2

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoUninitialize RoInitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString WindowsCreateStringReference WindowsGetStringRawBuffer

api-ms-win-core-console-l1-1-0

ReadConsoleW GetConsoleMode WriteConsoleW GetConsoleOutputCP

api-ms-win-core-console-l2-1-0

SetConsoleTextAttribute

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-debug-l1-1-0

OutputDebugStringA IsDebuggerPresent

api-ms-win-core-localization-l1-2-0

GetOEMCP FormatMessageA GetUserDefaultLCID LCMapStringW GetLocaleInfoEx GetCPInfo IsValidLocale EnumSystemLocalesW IsValidCodePage GetACP GetLocaleInfoW LCMapStringEx

api-ms-win-core-heap-l1-1-0

HeapCreate HeapFree HeapSize HeapAlloc HeapReAlloc GetProcessHeap

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot Thread32First Thread32Next

user32

CreateWindowExW DestroyWindow GetDC ReleaseDC GetForegroundWindow GetClassNameW IsWindow GetWindowThreadProcessId GetWindowLongW MapVirtualKeyW GetAsyncKeyState RegisterClassW FindWindowA EnumWindows DefWindowProcW GetKeyNameTextA IsWindowVisible GetWindowRect

gdi32

ChoosePixelFormat SetPixelFormat

shell32

SHGetKnownFolderPath

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx RtlCaptureContext RtlVirtualUnwind RtlUnwind

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-fibers-l1-1-0

FlsSetValue FlsFree FlsGetValue FlsAlloc

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

994KB

Virtual Size

993KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

372KB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_e1fc094a69ca3fbfa14852fe2be1d31d_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

crypt32

opengl32

ole32

bcrypt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-file-l1-2-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-toolhelp-l1-1-0

user32

gdi32

shell32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-fibers-l1-1-0

generic