2026-10-22_28f393dac9c78d8a72e2758685cac50e_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-10-22_28f393dac9c78d8a72e2758685cac50e_cobalt-strike_icedid_njrat_satacom_stealc
Size 415KB
Sample261024-w3q96afe26
SHA256 bbccc0ab770d1b93fd2bc8539bf1dbc8017a19a27cec6d62faa5c05ea6bdb8eb
MD5 28f393dac9c78d8a72e2758685cac50e
SHA1 7a71f305e1d4d096e56a20e2d96d85246759c383
SHA512 22699efec3e4cd62b16713267312a57bbcf819f3cd000870f851c985f52616b1c62e1b27485389ba389823fbb519ec7e2e7d253ed23b7826d0f67d7da1293e15
SSDEEP 6144:GpyqDP4FRjAyhBQO/kqhXTO/J5OO4Xp4oYRIX1F91mh4++gKvwwd6Rm4:WyqDCBxMqha/kXCIX11m6xvXdGz
TLSH
T1F5947D16E76804FDE277C5788D534906EB72BC4A0360EACF03989A671E276D49E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_28f393dac9c78d8a72e2758685cac50e_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-22_28f393dac9c78d8a72e2758685cac50e_cobalt-strike_icedid_njrat_satacom_stealc

.exe 415KB

2026-10-22_28f393dac9c78d8a72e2758685cac50e_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 5d6988dd66d75896761b4e29d80d5864
SHA256 bbccc0ab770d1b93fd2bc8539bf1dbc8017a19a27cec6d62faa5c05ea6bdb8eb
MD5 28f393dac9c78d8a72e2758685cac50e
SHA1 7a71f305e1d4d096e56a20e2d96d85246759c383
SHA512 22699efec3e4cd62b16713267312a57bbcf819f3cd000870f851c985f52616b1c62e1b27485389ba389823fbb519ec7e2e7d253ed23b7826d0f67d7da1293e15
SSDEEP 6144:GpyqDP4FRjAyhBQO/kqhXTO/J5OO4Xp4oYRIX1F91mh4++gKvwwd6Rm4:WyqDCBxMqha/kXCIX11m6xvXdGz
TLSH
T1F5947D16E76804FDE277C5788D534906EB72BC4A0360EACF03989A671E276D49E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

154656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpQueryHeaders

advapi32

RegCloseKey RegOpenKeyExA GetUserNameA

kernel32

SetEndOfFile GetCPInfo Process32First VirtualProtect SetConsoleTitleA GetCurrentProcess GetModuleHandleA CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetCurrentThread GetSystemDirectoryA LoadLibraryA Process32Next CloseHandle GetLocalTime GetProcAddress LocalFree GlobalMemoryStatusEx GetTickCount LoadLibraryExW IsDebuggerPresent GetComputerNameA CheckRemoteDebuggerPresent FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx WideCharToMultiByte LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetEnvironmentStringsW GetStringTypeW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapReAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW IsValidCodePage GetACP GetOEMCP FreeEnvironmentStringsW

ntdll

RtlCaptureContext RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwind

Name

.text

Size

293KB

Virtual Size

293KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_28f393dac9c78d8a72e2758685cac50e_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

advapi32

kernel32

ntdll

generic