2026-10-25_b449adbeb3a8190e695c914480dc6643_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_b449adbeb3a8190e695c914480dc6643_cobalt-strike_icedid_njrat_satacom_stealc
Size 837KB
Sample261026-sqlmcsey2t
SHA256 c5da9be507f39384096be9235d13e9ee62a6379ced6c3fd3114d6b31e5037a6b
MD5 b449adbeb3a8190e695c914480dc6643
SHA1 054b95c15a0475b258a12d425c7258742760aab2
SHA512 a9bf88fba82528f21d5367676d85f985bd95bef0de4932bb846180abdee362e8ea98d7b1cdfaf1562f498a7d0da82549d57f7fe16667aa2fdd36d49f3b3703d7
SSDEEP 24576:BlGNmrjvB6rei13/iHL7UF7PzDPldnAo81kZ5:2Nmojps/UZzjSyb
TLSH
T11D05E158AA8600B5D467D83DCBC69716EAB27883677177CB4BF006963F235F00B3AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

revoked_codesign

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
2026-10-25_b449adbeb3a8190e695c914480dc6643_cobalt-strike_icedid_njrat_satacom_stealc

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-25_b449adbeb3a8190e695c914480dc6643_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-25_b449adbeb3a8190e695c914480dc6643_cobalt-strike_icedid_njrat_satacom_stealc

.exe 837KB

2026-10-25_b449adbeb3a8190e695c914480dc6643_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH d771e2b4079eca1651a0385138c058ec
SHA256 c5da9be507f39384096be9235d13e9ee62a6379ced6c3fd3114d6b31e5037a6b
MD5 b449adbeb3a8190e695c914480dc6643
SHA1 054b95c15a0475b258a12d425c7258742760aab2
SHA512 a9bf88fba82528f21d5367676d85f985bd95bef0de4932bb846180abdee362e8ea98d7b1cdfaf1562f498a7d0da82549d57f7fe16667aa2fdd36d49f3b3703d7
SSDEEP 24576:BlGNmrjvB6rei13/iHL7UF7PzDPldnAo81kZ5:2Nmojps/UZzjSyb
TLSH
T11D05E158AA8600B5D467D83DCBC69716EAB27883677177CB4BF006963F235F00B3AB15
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5f:03:3a:74:a2:6f:13:03:c3:cf:3d:b6:19:a6:a1:77:70:85:95:b2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nanjing Zhixiao Information Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Nanjing Zhixiao Information Technology Co.\,Ltd,L=Nanjing,ST=Jiangsu,C=CN

Chains

Oct 26, 2026

CN=Nanjing Zhixiao Information Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Nanjing Zhixiao Information Technology Co.\,Ltd,L=Nanjing,ST=Jiangsu,C=CN

PE Signature issue

Digest

5f:03:3a:74:a2:6f:13:03:c3:cf:3d:b6:19:a6:a1:77:70:85:95:b2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=MEDIATEK INC.,O=MEDIATEK INC.,L=HSINCHU,ST=TAIWAN,C=TW

Chains

Oct 26, 2026

CN=MEDIATEK INC.,O=MEDIATEK INC.,L=HSINCHU,ST=TAIWAN,C=TW

Subject

CN=MEDIATEK INC.,O=MEDIATEK INC.,L=HSINCHU,ST=TAIWAN,C=TW

Serial Number

56:f0:08:e6:9a:7c:4c:3f:eb:38:9c:66:ea:f5:82:59

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Aug 24, 2015

Timespan

May 26, 2014 - Jun 24, 2017

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Nanjing Zhixiao Information Technology Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Nanjing Zhixiao Information Technology Co.\,Ltd,L=Nanjing,ST=Jiangsu,C=CN

Serial Number

20:e6:5f:5d:29:b5:82:24:10:50:4b:1a:c1:83:ca:3d

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 14, 2013 - Nov 14, 2014

Minor OS version

Major OS version

Entry point

98496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptGenRandom BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty BCryptOpenAlgorithmProvider BCryptCreateHash

shell32

ShellExecuteExW SHGetFolderPathW

advapi32

OpenSCManagerW QueryServiceStatusEx ChangeServiceConfig2W ChangeServiceConfigW RegQueryValueExW RegEnumKeyExW RegSaveKeyExW RegDeleteTreeA RegUnLoadKeyW RegSetValueExA RegRestoreKeyW RegOpenKeyExW RegLoadKeyW RegDeleteKeyA RegCreateKeyExA LookupPrivilegeValueW AllocateAndInitializeSid CheckTokenMembership FreeSid RegCloseKey RegCreateKeyExW RegFlushKey RegSetValueExW CloseServiceHandle ControlService CreateServiceW DuplicateTokenEx OpenServiceW QueryServiceStatus StartServiceW CreateProcessAsUserW SetThreadToken OpenProcessToken AdjustTokenPrivileges RevertToSelf

kernel32

GetTimeZoneInformation FindFirstFileExW IsValidCodePage SetEndOfFile GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetCurrentProcessId CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx GetFullPathNameW ReadFile WriteFile CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap WaitForSingleObject Sleep GetCurrentProcess GetExitCodeProcess CreateProcessW GetWindowsDirectoryW Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection IsWow64Process GetModuleFileNameW GetModuleHandleA GetProcAddress LoadLibraryA CopyFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW DeviceIoControl GetConsoleMode TerminateProcess OpenProcess GetSystemDirectoryW GetModuleHandleW LoadLibraryW WideCharToMultiByte GetTickCount64 QueryFullProcessImageNameW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetConsoleOutputCP WriteConsoleW HeapReAlloc HeapSize ReadConsoleW SetFilePointerEx GetStringTypeW RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer ExitProcess FreeLibrary GetModuleHandleExW GetStdHandle IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType FlushFileBuffers SetStdHandle

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RtlVirtualUnwind

Name

.text

Size

208KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

602KB

Virtual Size

602KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_b449adbeb3a8190e695c914480dc6643_cobalt-strike_icedid_njrat_satacom_stealc

PE Signature issue

PE Signature issue

bcrypt

shell32

advapi32

kernel32

ntdll

generic