2026-10-26_f6eba1912bca52938ced2a0b4bd444ad_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_f6eba1912bca52938ced2a0b4bd444ad_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.2MB
Sample261027-cbex9shy4x
SHA256 57021178c007928e60f60a34cb047185fe095846acbc95f89792752a97130f72
MD5 f6eba1912bca52938ced2a0b4bd444ad
SHA1 00f3413856c69a05203de14ae543ef15c9d22f9d
SHA512 afbdcef4de8400ff526f8c5c439dbc3ab85b5062fd2b9e6eeb0f691eb5498e60a9642ab80541d95ae5c1e44ed84aa754fda8e361ec901c96041a4c850f18dba2
SSDEEP 24576:fmWiMvnGt4QKJVJ36HWdsAj8nM6kHJ0Ec3Fzf9C2h0lhSMXl1WD:24Dp0EcxVCD
TLSH
T184453A0162B552E5F1FBD5758A9A7B05FAB2B41407294BCF475016A32F23EE4AE3BF00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_f6eba1912bca52938ced2a0b4bd444ad_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-26_f6eba1912bca52938ced2a0b4bd444ad_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.2MB

2026-10-26_f6eba1912bca52938ced2a0b4bd444ad_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH d406959b029838b477a2d3f609dd5b21
SHA256 57021178c007928e60f60a34cb047185fe095846acbc95f89792752a97130f72
MD5 f6eba1912bca52938ced2a0b4bd444ad
SHA1 00f3413856c69a05203de14ae543ef15c9d22f9d
SHA512 afbdcef4de8400ff526f8c5c439dbc3ab85b5062fd2b9e6eeb0f691eb5498e60a9642ab80541d95ae5c1e44ed84aa754fda8e361ec901c96041a4c850f18dba2
SSDEEP 24576:fmWiMvnGt4QKJVJ36HWdsAj8nM6kHJ0Ec3Fzf9C2h0lhSMXl1WD:24Dp0EcxVCD
TLSH
T184453A0162B552E5F1FBD5758A9A7B05FAB2B41407294BCF475016A32F23EE4AE3BF00
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

672704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comdlg32

GetOpenFileNameW

kernel32

GetCurrentProcess VirtualAllocEx VirtualFreeEx GetModuleHandleW GetProcAddress CreateFileW OutputDebugStringW CloseHandle DeviceIoControl GetCurrentThread GetCurrentThreadId GetThreadContext SetThreadContext WriteProcessMemory Sleep GetNativeSystemInfo OutputDebugStringA GetSystemTimeAsFileTime Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetEnvironmentVariableW GetCurrentDirectoryW GetSystemDirectoryW GetWindowsDirectoryW GetSystemWow64DirectoryW ActivateActCtx DeactivateActCtx CreateToolhelp32Snapshot Module32FirstW GetFileAttributesW LocalFree MultiByteToWideChar WideCharToMultiByte FreeLibrary LoadLibraryW DeleteFileW GetTempFileNameW WriteFile GetTempPathW CreateFileMappingW MapViewOfFile UnmapViewOfFile CreateActCtxW ReleaseActCtx TerminateProcess ResumeThread CreateProcessW Process32FirstW Process32NextW GetCurrentProcessId GetProcessId OpenProcess IsWow64Process DuplicateHandle ResetEvent WaitForSingleObject GetExitCodeThread ReadFile CreateNamedPipeW TerminateThread OpenThread SuspendThread GetThreadTimes Thread32First Thread32Next CreateRemoteThread VirtualProtectEx VirtualQueryEx ReadProcessMemory SetEndOfFile GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW HeapSize GetOEMCP GetACP IsValidCodePage EnterCriticalSection InitializeCriticalSection GetTickCount QueryPerformanceFrequency QueryPerformanceCounter GetSystemInfo GetModuleFileNameW GetExitCodeProcess DeleteCriticalSection InitializeCriticalSectionEx GetLastError DecodePointer LeaveCriticalSection HeapReAlloc FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetFileInformationByHandleEx GetConsoleMode WriteConsoleW GetStringTypeW EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent RaiseException WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree SetStdHandle GetFileType RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter ExitProcess GetModuleHandleExW GetStdHandle GetCommandLineA GetCommandLineW HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetFileSizeEx SetFilePointerEx ReadConsoleW RtlUnwind

user32

wsprintfW

ole32

CoUninitialize CoCreateInstance CoInitialize

oleaut32

SysFreeString

advapi32

RegOpenKeyW RegCreateKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumValueW RegQueryValueExW RegOpenKeyExW LookupPrivilegeValueW AdjustTokenPrivileges OpenThreadToken OpenProcessToken RegSetValueExW RegCloseKey

shlwapi

SHDeleteKeyW

Name

.text

Size

825KB

Virtual Size

825KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

307KB

Virtual Size

306KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_f6eba1912bca52938ced2a0b4bd444ad_cobalt-strike_icedid_njrat_satacom_stealc

comdlg32

kernel32

user32

ole32

oleaut32

advapi32

shlwapi

generic