2026-10-26_bb5f1e2195d1405661d9d0a5f514f443_cobalt-strike_icedid_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_bb5f1e2195d1405661d9d0a5f514f443_cobalt-strike_icedid_satacom
Size 217KB
Sample261027-j2rhbacv5p
SHA256 847a08963e82bc56a8a264747606461d1ece474857c96824daec623597fa2489
MD5 bb5f1e2195d1405661d9d0a5f514f443
SHA1 23c4ffca4427ebb0badc3dcfaf7aad7155a5a318
SHA512 545ddd65a95fcb05172a580a6e13fb2056afae44b9f2d431132bb02e56d565e83bdbaf8d701403d9eb2c5d22e2cb864a9db77a58479078e2dce2684a3ee08215
SSDEEP 3072:X09dMETIe1Q3AOAccWCfvpq1uGKphzd0sKtp9b9WgM/ldx4NOuh9TZmxtUrpFBVD:Xde1HWc7fvMIK06UAXo
TLSH
T194249E15B2E659F6E973453589A96612BA3378161330DEFF03A0863CEF272C05E7BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_bb5f1e2195d1405661d9d0a5f514f443_cobalt-strike_icedid_satacom

File Explorer

2026-10-26_bb5f1e2195d1405661d9d0a5f514f443_cobalt-strike_icedid_satacom

.exe 217KB

2026-10-26_bb5f1e2195d1405661d9d0a5f514f443_cobalt-strike_icedid_satacom

IMPHASH b7fbaf66ec8fddfee6f5e862ba6e16fa
SHA256 847a08963e82bc56a8a264747606461d1ece474857c96824daec623597fa2489
MD5 bb5f1e2195d1405661d9d0a5f514f443
SHA1 23c4ffca4427ebb0badc3dcfaf7aad7155a5a318
SHA512 545ddd65a95fcb05172a580a6e13fb2056afae44b9f2d431132bb02e56d565e83bdbaf8d701403d9eb2c5d22e2cb864a9db77a58479078e2dce2684a3ee08215
SSDEEP 3072:X09dMETIe1Q3AOAccWCfvpq1uGKphzd0sKtp9b9WgM/ldx4NOuh9TZmxtUrpFBVD:Xde1HWc7fvMIK06UAXo
TLSH
T194249E15B2E659F6E973453589A96612BA3378161330DEFF03A0863CEF272C05E7BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winmm

waveOutWrite waveOutUnprepareHeader waveOutReset waveOutOpen waveOutPrepareHeader

kernel32

GetLastError lstrcatW DeleteFileW CloseHandle LoadLibraryW CreateThread GetProcAddress LocalFree CreateProcessW CopyFileW lstrcpyW lstrcmpW GetCurrentThreadId HeapAlloc GetProcessHeap CreateMutexW WaitForSingleObject TerminateThread FreeLibrary HeapFree GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize Sleep LCMapStringW LoadLibraryExW VirtualProtect GetStringTypeW GetFileType SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP GetLogicalDriveStringsW SetFileAttributesW CreateFileW FindClose GetTempPathW GetModuleFileNameW RemoveDirectoryW WriteFile GetCurrentProcess FindFirstFileW FindNextFileW ReadFile GetConsoleMode SetFilePointerEx WriteConsoleW IsValidCodePage FindFirstFileExW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle ExitProcess TerminateProcess GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter

user32

GetMessageW DispatchMessageW SetTimer TranslateMessage EnumDisplayMonitors GetWindowRect GetDC EnumChildWindows CallNextHookEx GetSystemMetrics SetWindowTextW DrawIcon DestroyCursor ShowWindow GetCursorInfo RedrawWindow MoveWindow UnhookWindowsHookEx EnumWindows mouse_event SetWindowsHookExW SetCursorPos ReleaseDC EnableWindow MessageBoxW ExitWindowsEx

gdi32

DeleteDC CreatePen Ellipse DeleteObject CreateSolidBrush BitBlt SelectObject CreateDIBSection CreateCompatibleDC StretchBlt

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid SetEntriesInAclW SetNamedSecurityInfoW FreeSid OpenProcessToken

shell32

ShellExecuteW

Name

.text

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_bb5f1e2195d1405661d9d0a5f514f443_cobalt-strike_icedid_satacom

winmm

kernel32

user32

gdi32

advapi32

shell32

generic