2026-10-22_3321ddce236fb6f7640a3b17c02255ec_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_3321ddce236fb6f7640a3b17c02255ec_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.6MB
Sample261024-vrexbabs2w
SHA256 b44410aa70fe4f1c482d2ad29d9f7e613b763406053ee0caf45c6ff36aaf54f4
MD5 3321ddce236fb6f7640a3b17c02255ec
SHA1 e58c39b05bf670876a469752b28dbe64953f17d8
SHA512 cfdd0f0ac80ee49868dc59ec0a03181a084ebdd77afc6f05fae30b6f60c3b9668e33b950dedf1e77b3636d1779da69aa19010512df8afae6e306bb6df15c239d
SSDEEP 24576:3EJt64gJ9oetT6T/6dunnn1pcKa4zoYQPBorR+pC7I6n+vp/UikPQN:3EVA9oetT6zl7zqyrR+yn6
TLSH
T17A75B053E9A401FCD077D2BCCA56A907EAB238464B306ADF13F08D561F67AE05A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_3321ddce236fb6f7640a3b17c02255ec_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-22_3321ddce236fb6f7640a3b17c02255ec_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.6MB

2026-10-22_3321ddce236fb6f7640a3b17c02255ec_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 87f5d0854d2d3679554c8bae24d8c6bf
SHA256 b44410aa70fe4f1c482d2ad29d9f7e613b763406053ee0caf45c6ff36aaf54f4
MD5 3321ddce236fb6f7640a3b17c02255ec
SHA1 e58c39b05bf670876a469752b28dbe64953f17d8
SHA512 cfdd0f0ac80ee49868dc59ec0a03181a084ebdd77afc6f05fae30b6f60c3b9668e33b950dedf1e77b3636d1779da69aa19010512df8afae6e306bb6df15c239d
SSDEEP 24576:3EJt64gJ9oetT6T/6dunnn1pcKa4zoYQPBorR+pC7I6n+vp/UikPQN:3EVA9oetT6zl7zqyrR+yn6
TLSH
T17A75B053E9A401FCD077D2BCCA56A907EAB238464B306ADF13F08D561F67AE05A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

909872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice D3D11CreateDeviceAndSwapChain

dxgi

CreateDXGIFactory1

d3dcompiler_47

D3DCompile

winhttp

WinHttpReadData WinHttpOpen WinHttpCloseHandle WinHttpCrackUrl WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpQueryDataAvailable WinHttpConnect

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGenRandom BCryptDestroyHash BCryptCreateHash BCryptHashData BCryptFinishHash

dwmapi

DwmGetWindowAttribute DwmExtendFrameIntoClientArea

kernel32

SetUnhandledExceptionFilter GetLastError SetErrorMode HeapAlloc GetProcessHeap DeviceIoControl WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId GetExitCodeProcess CreateRemoteThread GetCurrentThreadId OpenThread SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache OpenProcess GetLocalTime GetNativeSystemInfo VirtualProtect VirtualAllocEx VirtualProtectEx VirtualQueryEx ReadProcessMemory WriteProcessMemory VirtualFreeEx GetModuleFileNameW GetModuleHandleW GetModuleHandleExW GetProcAddress LocalFree QueryFullProcessImageNameW WideCharToMultiByte FreeConsole SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW Thread32First Thread32Next Module32FirstW Module32NextW FileTimeToLocalFileTime GetFileAttributesExW LoadResource LockResource SizeofResource FindResourceW MoveFileExW FileTimeToSystemTime VirtualAlloc VirtualFree GetModuleHandleA GetTempPathW K32EnumDeviceDrivers K32GetDeviceDriverBaseNameA K32GetDeviceDriverFileNameA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA CloseHandle GetCurrentDirectoryW GetDateFormatW LoadLibraryExW HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle TerminateProcess ExitProcess IsProcessorFeaturePresent ReadFile DeleteFileW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW GetCPInfo LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable WakeConditionVariable RaiseException GetFileInformationByHandleEx CreateFileW GetTimeFormatW CompareStringW LCMapStringW GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP HeapReAlloc GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFinalPathNameByHandleW FindNextFileW FindFirstFileExW FindFirstFileW FindClose HeapSize SetEndOfFile WriteConsoleW GetLocaleInfoA RtlUnwind FormatMessageA GetLocaleInfoEx WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW CreateDirectoryW

user32

GetKeyNameTextW MapVirtualKeyW MessageBoxW SetProcessDpiAwarenessContext TranslateMessage DispatchMessageW PeekMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow GetAsyncKeyState SetLayeredWindowAttributes ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadCursorW FindWindowW SetWindowLongPtrW GetWindowLongPtrW GetWindowRect SetForegroundWindow UpdateWindow GetSystemMetrics SetWindowPos IsIconic SetWindowDisplayAffinity

shell32

ShellExecuteW SHGetKnownFolderPath ShellExecuteA

comdlg32

GetOpenFileNameW

comctl32

ord345 InitCommonControlsEx

crypt32

CryptUnprotectData CryptProtectData

ole32

CoCreateInstance CoUninitialize CoTaskMemFree CoInitializeEx

advapi32

RegCloseKey AllocateAndInitializeSid CheckTokenMembership FreeSid RegGetValueW RegCreateKeyW RegEnumKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegDeleteTreeW RegSetKeyValueW RegQueryValueExW RegOpenKeyExW RegOpenKeyW

ntdll

NtQuerySystemInformation RtlPcToFileHeader RtlInitUnicodeString NtLoadDriver NtUnloadDriver RtlAdjustPrivilege

dbghelp

MiniDumpWriteDump

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

333KB

Virtual Size

332KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

118KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_3321ddce236fb6f7640a3b17c02255ec_cobalt-strike_icedid_njrat_satacom_stealc

d3d11

dxgi

d3dcompiler_47

winhttp

bcrypt

dwmapi

kernel32

user32

shell32

comdlg32

comctl32

crypt32

ole32

advapi32

ntdll

dbghelp

imm32

generic