2026-10-26_a769f5a75a00c8afd8cae2901e19d96d_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_a769f5a75a00c8afd8cae2901e19d96d_cobalt-strike_icedid_njrat_satacom_stealc
Size 305KB
Sample261027-lyc7mazy2p
SHA256 1750cee581943f894ef2f245b3e9563f9b460e9a749019789c541cc2ecf6a22c
MD5 a769f5a75a00c8afd8cae2901e19d96d
SHA1 567be352e7bd8b96bff84bb71aa71a6066e4c93f
SHA512 3af7d162142dc68b9381a55693dd14ec9915e8d0e05d150f1a1991fa92d0630b1b5f0085ff1bc9c54a6e1317fdbb5a2b4d22f2856703d45fac0bb8d8e67c01a2
SSDEEP 6144:MM3ARg31iitiKWBW4Wgdj3OWF+7n96xgx:vsgw0OW4zRN+j
TLSH
T190647C25E6A810F9E577C27CCE524902EB72BC460771EACF139059A63F236D49E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_a769f5a75a00c8afd8cae2901e19d96d_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-26_a769f5a75a00c8afd8cae2901e19d96d_cobalt-strike_icedid_njrat_satacom_stealc

.exe 305KB

2026-10-26_a769f5a75a00c8afd8cae2901e19d96d_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 6ae254eecf98699a211d48b1ec15fc07
SHA256 1750cee581943f894ef2f245b3e9563f9b460e9a749019789c541cc2ecf6a22c
MD5 a769f5a75a00c8afd8cae2901e19d96d
SHA1 567be352e7bd8b96bff84bb71aa71a6066e4c93f
SHA512 3af7d162142dc68b9381a55693dd14ec9915e8d0e05d150f1a1991fa92d0630b1b5f0085ff1bc9c54a6e1317fdbb5a2b4d22f2856703d45fac0bb8d8e67c01a2
SSDEEP 6144:MM3ARg31iitiKWBW4Wgdj3OWF+7n96xgx:vsgw0OW4zRN+j
TLSH
T190647C25E6A810F9E577C27CCE524902EB72BC460771EACF139059A63F236D49E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

86080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen

user32

GetMessageW TranslateMessage DispatchMessageW PostThreadMessageW OpenClipboard CloseClipboard GetClipboardData GetAsyncKeyState GetKeyboardState ToUnicode VkKeyScanA VkKeyScanW SendInput GetSystemMetrics EnumDisplayMonitors CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetCursorPos SetCursorPos GetWindowTextW ReleaseDC GetDC GetForegroundWindow

advapi32

GetTokenInformation GetUserNameA RegCloseKey RegDeleteValueW RegOpenKeyExW RegSetValueExW OpenProcessToken

gdi32

CreateCompatibleDC DeleteDC DeleteObject SelectObject StretchBlt SetStretchBltMode CreateCompatibleBitmap

gdiplus

GdipGetImageEncoders GdipFree GdipAlloc GdipSaveImageToStream GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipCloneImage GdipDisposeImage GdiplusStartup

ole32

CreateStreamOnHGlobal GetHGlobalFromStream

kernel32

HeapReAlloc GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID FindFirstFileExW GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW IsValidLocale CreateProcessW GetFileType UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext HeapFree HeapAlloc GetProcAddress GetModuleHandleExW FreeLibrary GetStdHandle IsProcessorFeaturePresent CreateFileW FindClose FindFirstFileW FindNextFileW GetFileSizeEx ReadFile WriteFile CloseHandle SetHandleInformation GetLastError CreatePipe InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WaitForSingleObject CreateMutexW Sleep GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess CreateThread CreateProcessA OpenProcess GetTickCount GetModuleFileNameW GetModuleHandleW GlobalSize GlobalUnlock GlobalLock GetComputerNameA MultiByteToWideChar WideCharToMultiByte InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW FlsFree RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue

Name

.text

Size

202KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_a769f5a75a00c8afd8cae2901e19d96d_cobalt-strike_icedid_njrat_satacom_stealc

winhttp

user32

advapi32

gdi32

gdiplus

ole32

kernel32

generic