2026-10-22_af3588c3c107e58d9b8dc7c6d28b2d51_cobalt-strike_icedid_satacom

General

Target
2026-10-22_af3588c3c107e58d9b8dc7c6d28b2d51_cobalt-strike_icedid_satacom
Size 311KB
Sample261024-asemqa1xdw
SHA256 bc901ffc6f4e96bf392371c557f42b1d670fca3668ea42a25eaf6333acb6bd4a
MD5 af3588c3c107e58d9b8dc7c6d28b2d51
SHA1 6dc13e3baad153efee9c19a9a5ee8972d227e3a6
SHA512 e21bf8c3a6169bc29500dd5acf4c132a398f7e95881a5fd8c83b95d9c1557a5f76a64be900c3acfaf304fa8776bcf696490586921187b9e5201acbcae04f7e03
SSDEEP 6144:5Eeu4A1sNRiWMrkbUnADZ8rK1HJIth0IfgoNnWDinsuquta3wtj:5Eer2WckbKw+zth0wTmujagtj
TLSH
T1B3649C1B17A4A4EAD2119B3C9891E728877773B0FB15C7EF566106C52E21FC38E3DA90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-22_af3588c3c107e58d9b8dc7c6d28b2d51_cobalt-strike_icedid_satacom

File Explorer

2026-10-22_af3588c3c107e58d9b8dc7c6d28b2d51_cobalt-strike_icedid_satacom

.exe 311KB

2026-10-22_af3588c3c107e58d9b8dc7c6d28b2d51_cobalt-strike_icedid_satacom

IMPHASH fc8022ee29bbb539a792c23ae6b77eb1
SHA256 bc901ffc6f4e96bf392371c557f42b1d670fca3668ea42a25eaf6333acb6bd4a
MD5 af3588c3c107e58d9b8dc7c6d28b2d51
SHA1 6dc13e3baad153efee9c19a9a5ee8972d227e3a6
SHA512 e21bf8c3a6169bc29500dd5acf4c132a398f7e95881a5fd8c83b95d9c1557a5f76a64be900c3acfaf304fa8776bcf696490586921187b9e5201acbcae04f7e03
SSDEEP 6144:5Eeu4A1sNRiWMrkbUnADZ8rK1HJIth0IfgoNnWDinsuquta3wtj:5Eer2WckbKw+zth0wTmujagtj
TLSH
T1B3649C1B17A4A4EAD2119B3C9891E728877773B0FB15C7EF566106C52E21FC38E3DA90
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ba:4b:7b:14:1f:ee:d4:e5:95:ca:05:1c:da:b5:fb:27:f5:b0:a6:1a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US

Chains

Apr 7, 2016

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US

Subject

CN=viper,O=take2games,L=San Francisco,ST=California,C=US,1.2.840.113549.1.9.1=#0c18436f707972696768744074616b653267616d65732e636f6d

Serial Number

03:e8

Issuer

CN=viper,O=take2games,L=San Francisco,ST=California,C=US,1.2.840.113549.1.9.1=#0c18436f707972696768744074616b653267616d65732e636f6d

Timespan

Jan 27, 2025 - Jan 27, 2026

Subject

CN=Take-Two Interactive Software\, Inc.,OU=Rockstar Games+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Take-Two Interactive Software\, Inc.,L=New York,ST=New York,C=US

Serial Number

69:50:43:d6:8f:15:55:0f:d5:db:37:0f:a8:81:7b:04

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 21, 2011 - Sep 20, 2013

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

6

Entry point

10384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

192KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-10-22_af3588c3c107e58d9b8dc7c6d28b2d51_cobalt-strike_icedid_satacom

PE Signature issue

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_af3588c3c107e58d9b8dc7c6d28b2d51_cobalt-strike_icedid_satacom

PE Signature issue

kernel32

generic