2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom

General

Target
2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom
Size 3.1MB
Sample261027-efv66ax16k
SHA256 868e831b43826ca8d23cb0f3b32c5961c9e87f5e2ac8de4efe9727ac35a196ef
MD5 e7633f675119a0c3acf68681c9ddf6dc
SHA1 7039eb2cd981efcc9fccfc9bff2c39f1bdd665e6
SHA512 99e63cdacc1aded1040a81e149f982f1cca22347c6a2d4a7da85cd51a6d539acf731dfa6a7fafe57211cd278293af331829bc6d52fa465ade8776a371105f248
SSDEEP 24576:JmmBoHjto1GFxlXutIs1WZX5ARS1pgZ6SdCJn1tuXsbvpWLKoAaLXmoHjto1GFxg:omaT/M+w4pg7dCDt4cYLKoHL3T/M+w
TLSH
T1A1E5E1616A051EFCEBF0B674EBCE536553A52EA2013744CF13D03F8A3937952BEAA051
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom

File Explorer

2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom

.exe 3.1MB

2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom

IMPHASH 7a2e9445611b673c29cf19c5cb1af698
SHA256 868e831b43826ca8d23cb0f3b32c5961c9e87f5e2ac8de4efe9727ac35a196ef
MD5 e7633f675119a0c3acf68681c9ddf6dc
SHA1 7039eb2cd981efcc9fccfc9bff2c39f1bdd665e6
SHA512 99e63cdacc1aded1040a81e149f982f1cca22347c6a2d4a7da85cd51a6d539acf731dfa6a7fafe57211cd278293af331829bc6d52fa465ade8776a371105f248
SSDEEP 24576:JmmBoHjto1GFxlXutIs1WZX5ARS1pgZ6SdCJn1tuXsbvpWLKoAaLXmoHjto1GFxg:omaT/M+w4pg7dCDt4cYLKoHL3T/M+w
TLSH
T1A1E5E1616A051EFCEBF0B674EBCE536553A52EA2013744CF13D03F8A3937952BEAA051
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\steam_rel_client_hotfix_win64\build\src\overlay\gameoverlayuiexe\win64\Release\gameoverlayui64_exe.pdb

kernel32

FreeLibrary GetModuleFileNameW GetModuleHandleA GetProcAddress LoadLibraryA LoadLibraryW WriteConsoleW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetCommandLineA GetCommandLineW GetStdHandle WriteFile GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle

Name

.text

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

294KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_e7633f675119a0c3acf68681c9ddf6dc_cobalt-strike_icedid_satacom

kernel32

generic