2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc
Size 13.8MB
Sample261024-vazv6aa12w
SHA256 219b3706be48bf1f3f992e18fe1860ab792de3d691c38197f0839ec92818f782
MD5 368415b34c2c7ed14790c31159ce1aef
SHA1 8c355369185bcef762516602cd869bd0195380c3
SHA512 1ce4333f1113ac56f3b497400c0de40e9bd005667072809bad52ede49963e0c31947b1ad63d2fcb5cadf3ef07901985c25cf09eb8818f9396d9c425ab8b31c43
SSDEEP 196608:Bm5cls0Digl/+bTMZNt2O2pY8dMXUbWWz+F/8MP/3rZNcA2tiEZ/djFFum/5Sztd:gclVtR+bgMOMtWWz+F0a/9Nh5Eptn/m
TLSH
T127E60247739E57E9C032A4388F01E113FEE2BC041739B2EBE6A189155A276F10E7D766
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc

.exe 13.8MB

2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH aaa3be8dcf110c20c73b8a9c8675ee59
SHA256 219b3706be48bf1f3f992e18fe1860ab792de3d691c38197f0839ec92818f782
MD5 368415b34c2c7ed14790c31159ce1aef
SHA1 8c355369185bcef762516602cd869bd0195380c3
SHA512 1ce4333f1113ac56f3b497400c0de40e9bd005667072809bad52ede49963e0c31947b1ad63d2fcb5cadf3ef07901985c25cf09eb8818f9396d9c425ab8b31c43
SSDEEP 196608:Bm5cls0Digl/+bTMZNt2O2pY8dMXUbWWz+F/8MP/3rZNcA2tiEZ/djFFum/5Sztd:gclVtR+bgMOMtWWz+F0a/9Nh5Eptn/m
TLSH
T127E60247739E57E9C032A4388F01E113FEE2BC041739B2EBE6A189155A276F10E7D766
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1569456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dcompiler_47

D3DCompile

kernel32

QueryFullProcessImageNameA CreateFileA GetCurrentThread AcquireSRWLockExclusive GetSystemDirectoryA LoadLibraryA DeleteFileA DeleteFileW Process32FirstW CloseHandle K32GetModuleBaseNameA CreateThread GetWindowsDirectoryA GetLocalTime K32EnumProcesses GetThreadContext GetProcAddress LocalFree MoveFileExW ExitProcess GetCurrentProcessId CreateProcessW GetModuleHandleW FreeLibrary WideCharToMultiByte GetConsoleWindow CreateProcessA K32EnumProcessModules lstrcmpiW GetTickCount lstrcmpW IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent GetExitCodeProcess MoveFileA FindFirstFileA FindNextFileA FindClose GetTempPathA GetFileAttributesA QueryFullProcessImageNameW CreateDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter OutputDebugStringA SetEndOfFile HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale MoveFileExA LCMapStringW CompareStringW LoadLibraryExW HeapFree HeapAlloc GetFileSizeEx GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetCommandLineA GetModuleFileNameW IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader Process32NextW ReleaseSRWLockExclusive GetLastError GetTickCount64 Sleep MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess GetModuleHandleA CreateFileW WaitForSingleObject GetVolumeInformationA CreateMutexA GetEnvironmentVariableA K32GetDeviceDriverBaseNameA GetTempPathW TerminateProcess DeviceIoControl WriteFile K32GetDeviceDriverFileNameA GetStdHandle WriteConsoleW RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW GetCPInfo CompareStringEx WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection FindNextFileW FindFirstFileExW GetCurrentProcess SetConsoleTitleA GetCommandLineW VirtualProtect GetModuleFileNameA ReadFile K32EnumDeviceDrivers GetLocaleInfoW GetCurrentThreadId SleepConditionVariableSRW InitOnceComplete InitOnceBeginInitialize

user32

TranslateMessage SetLayeredWindowAttributes EnumWindows MessageBoxA GetWindowTextA PeekMessageW DispatchMessageW GetAsyncKeyState ShowWindow RegisterClassExW GetWindowLongPtrW GetSystemMetrics CreateWindowExW FindWindowA IsWindowVisible DestroyWindow DefWindowProcW UnregisterClassW ScreenToClient SetWindowRgn SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard PostQuitMessage UpdateWindow GetCursorPos SetWindowLongPtrW GetKeyState GetMessageExtraInfo GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos

gdi32

CreateRoundRectRgn

advapi32

RegCloseKey RegSetKeyValueA RegCreateKeyW OpenProcessToken RegSetValueExW GetUserNameA RegDeleteKeyW RegGetValueA RegOpenKeyA AdjustTokenPrivileges AllocateAndInitializeSid FreeSid CheckTokenMembership LookupPrivilegeValueW LookupPrivilegeValueA

shell32

CommandLineToArgvW ShellExecuteA ShellExecuteW ShellExecuteExA

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

wininet

InternetReadFile InternetCloseHandle InternetOpenA InternetOpenUrlA

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable

ntdll

RtlInitUnicodeString

bcrypt

BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptGetProperty

urlmon

URLDownloadToFileA

crypt32

CryptProtectData CryptUnprotectData

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.0MB

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

696B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_368415b34c2c7ed14790c31159ce1aef_cobalt-strike_icedid_njrat_satacom_stealc

d3dcompiler_47

kernel32

user32

gdi32

advapi32

shell32

d3d11

dwmapi

wininet

winhttp

ntdll

bcrypt

urlmon

crypt32

imm32

generic