2026-10-22_9c29defd674a2c5b352741e8d8da8834_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_9c29defd674a2c5b352741e8d8da8834_cobalt-strike_icedid_njrat_satacom_stealc
Size 947KB
Sample261024-dp65cahv2k
SHA256 ed8b1aa8d36467f3ff169d3c5facd0d0dc9d5a2a44dfb461fece5067b388726a
MD5 9c29defd674a2c5b352741e8d8da8834
SHA1 70729f29a06e64f3d4973d9acc8c7d7fcc5ecfba
SHA512 7e8e1d652f214bae9715a46f7b1912d606e6b0a1d29ce10ec5eeb1c83c7e4f7d690f7d0d933348c815c2db3fee3ae7a1bf6eecb7a3da9ecbfa6337eb825511a1
SSDEEP 12288:H6rTc4UJzA/W3F8unx32kUycY6k19FKyDFrb7DuLMOKvnDXiy9OrhBcm+VXJjY0h:H6SJzAxunx32MRThj0Ta+zhTU9vWs
TLSH
T16B251A1AB98DD5B9E587CC78A64F09031A3475DF1765A8EF43C8AD723EA72B40B31B04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_9c29defd674a2c5b352741e8d8da8834_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-22_9c29defd674a2c5b352741e8d8da8834_cobalt-strike_icedid_njrat_satacom_stealc

.exe 947KB

2026-10-22_9c29defd674a2c5b352741e8d8da8834_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH ad699e731a46c6d968bd4bedf751608a
SHA256 ed8b1aa8d36467f3ff169d3c5facd0d0dc9d5a2a44dfb461fece5067b388726a
MD5 9c29defd674a2c5b352741e8d8da8834
SHA1 70729f29a06e64f3d4973d9acc8c7d7fcc5ecfba
SHA512 7e8e1d652f214bae9715a46f7b1912d606e6b0a1d29ce10ec5eeb1c83c7e4f7d690f7d0d933348c815c2db3fee3ae7a1bf6eecb7a3da9ecbfa6337eb825511a1
SSDEEP 12288:H6rTc4UJzA/W3F8unx32kUycY6k19FKyDFrb7DuLMOKvnDXiy9OrhBcm+VXJjY0h:H6SJzAxunx32MRThj0Ta+zhTU9vWs
TLSH
T16B251A1AB98DD5B9E587CC78A64F09031A3475DF1765A8EF43C8AD723EA72B40B31B04
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

662896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

RtlVirtualUnwind RtlCaptureContext RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry NtResumeThread NtSetContextThread NtGetContextThread NtWriteVirtualMemory NtClose NtMapViewOfSection NtCreateSection NtWriteFile NtSetInformationFile NtOpenFile RtlInitUnicodeString

winhttp

WinHttpOpenRequest WinHttpOpen WinHttpConnect WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpQueryHeaders WinHttpReadData

bcrypt

BCryptEncrypt BCryptGenRandom BCryptDecrypt BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey

shell32

CommandLineToArgvW SHGetFolderPathW

ole32

CoCreateGuid CoUninitialize CoInitializeEx CoCreateInstance CoSetProxyBlanket

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

advapi32

RegDeleteValueW ConvertSidToStringSidW GetTokenInformation OpenProcessToken RegEnumKeyExW RegDeleteTreeW RegEnumValueW RegSetValueExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW

kernel32

FindFirstFileExW FindClose WriteConsoleW GetFileType HeapAlloc HeapFree LCMapStringW CompareStringW LoadLibraryExW UnhandledExceptionFilter FindNextFileW IsProcessorFeaturePresent GetProcAddress GetModuleHandleExW FreeLibrary ExitProcess GetStdHandle DeleteCriticalSection InitializeCriticalSectionEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW GetProcessHeap IsDebuggerPresent Process32NextW CreateMutexW GetLastError RemoveDirectoryW QueryPerformanceCounter GetTickCount64 GetCurrentProcessId GetCurrentThreadId Sleep CloseHandle GetEnvironmentVariableW MultiByteToWideChar CreateProcessW CreateFileW WriteFile GetModuleFileNameW GetCurrentProcess LocalFree CreateDirectoryW CopyFileW DeleteFileW WideCharToMultiByte ReadFile GetFileSizeEx SetLastError GetFileAttributesExW GetFileAttributesW OpenProcess GetProcessTimes WaitForSingleObject CreateToolhelp32Snapshot Process32FirstW FlsGetValue QueryFullProcessImageNameW TerminateProcess SetEnvironmentVariableW GetExitCodeProcess GetStartupInfoW GetTempPathW GetTempFileNameW GetCommandLineW GetWindowsDirectoryW Wow64GetThreadContext Wow64SetThreadContext VirtualAlloc VirtualFree VirtualProtect FlsAlloc RaiseException GetModuleHandleW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable ReleaseSRWLockExclusive AcquireSRWLockExclusive SetFilePointerEx

Name

.text

Size

761KB

Virtual Size

764KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

149KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

4KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.mscfg

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_9c29defd674a2c5b352741e8d8da8834_cobalt-strike_icedid_njrat_satacom_stealc

ntdll

winhttp

bcrypt

shell32

ole32

oleaut32

advapi32

kernel32

generic