2026-10-22_58e26195ea8ed7f55ef7eba24df18430_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-10-22_58e26195ea8ed7f55ef7eba24df18430_cobalt-strike_icedid_njrat_satacom_stealc
Size 318KB
Sample261024-pmlleat1ay
SHA256 7b983f2078b855f0e346a9093cd01bb59b2a0830c9ee62145db038adc1805b68
MD5 58e26195ea8ed7f55ef7eba24df18430
SHA1 697ec60c1de3b7e89dbc70afc6a7cdcbc19a7b20
SHA512 2d315320e2e6252748f8cf9b4557d5d0df8be045d47b4daa2783ca6d8797f5fa4807596e67d87ce3bf652b745bc4f5ef9d885c70a6c147946166bd5a3eaf4408
SSDEEP 6144:uQkhL1zz8PkZlV0BRCxViexOo0QLg6Nj8L/jAcI/m2B:udX0BjAZ0zpLkcK
TLSH
T1A6647C55F7AD50F9E9B7923CC9424502EAB2BC560370EBCB17904A962F237D09E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_58e26195ea8ed7f55ef7eba24df18430_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-22_58e26195ea8ed7f55ef7eba24df18430_cobalt-strike_icedid_njrat_satacom_stealc

.exe 318KB

2026-10-22_58e26195ea8ed7f55ef7eba24df18430_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 8b3e466ee46d02056eaf86b29b42a464
SHA256 7b983f2078b855f0e346a9093cd01bb59b2a0830c9ee62145db038adc1805b68
MD5 58e26195ea8ed7f55ef7eba24df18430
SHA1 697ec60c1de3b7e89dbc70afc6a7cdcbc19a7b20
SHA512 2d315320e2e6252748f8cf9b4557d5d0df8be045d47b4daa2783ca6d8797f5fa4807596e67d87ce3bf652b745bc4f5ef9d885c70a6c147946166bd5a3eaf4408
SSDEEP 6144:uQkhL1zz8PkZlV0BRCxViexOo0QLg6Nj8L/jAcI/m2B:udX0BjAZ0zpLkcK
TLSH
T1A6647C55F7AD50F9E9B7923CC9424502EAB2BC560370EBCB17904A962F237D09E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

51184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetCurrentConsoleFontEx GetTempPathW CreateFileW CreateToolhelp32Snapshot Sleep GetConsoleMode Process32NextW DeleteFileW Process32FirstW CloseHandle GetLocalTime SetConsoleMode GetProcAddress GetFileSize GetModuleHandleW SetConsoleOutputCP SetConsoleTitleW SetEndOfFile HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW FindFirstFileExW WriteConsoleA GetStdHandle SetConsoleTextAttribute WriteConsoleW ReadFile FindClose HeapReAlloc GetOEMCP GetACP IsValidCodePage QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId GetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP HeapFree HeapAlloc VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW RtlUnwind

user32

GetClassNameW EnumWindows IsWindowVisible GetWindowThreadProcessId

advapi32

RegCloseKey RegDeleteTreeW RegCreateKeyW RegSetKeyValueW

ntdll

NtUnloadDriver NtAllocateVirtualMemory RtlAdjustPrivilege NtLoadDriver RtlInitUnicodeString NtFreeVirtualMemory

Name

.text

Size

180KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

117KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

816B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_58e26195ea8ed7f55ef7eba24df18430_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

ntdll

generic