2026-10-26_9608194289a7859347ceb06a72532927_cobalt-strike_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_9608194289a7859347ceb06a72532927_cobalt-strike_icedid_njrat_satacom
Size 2.2MB
Sample261027-nkh7tstvbv
SHA256 658a4b4a4dc3b5c4f4f60db15927a9accea224fb8fdbff85a6bac403e48591aa
MD5 9608194289a7859347ceb06a72532927
SHA1 c62b71a2cce85e727e3d0d383d23faafc95262da
SHA512 7628ff5396325c780cbc280f44ec29a3e8d4d6468c903d1d733edd1b7742c1229005a70d7b30c140804673cb0760236dd5368d806678868054cd5679c029a01b
SSDEEP 49152:ZKagaeoBzaXmlffKnSDWL6xyqUe/FqVHQxmAevlDhXwu:ZKagalrlf2vL6Mk8VMmbr
TLSH
T1BBA5E056A3A800F8D077C274CA565607EBB2F806273497CF53948D5A6F23BB25E7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_9608194289a7859347ceb06a72532927_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-10-26_9608194289a7859347ceb06a72532927_cobalt-strike_icedid_njrat_satacom

.exe 2.2MB

2026-10-26_9608194289a7859347ceb06a72532927_cobalt-strike_icedid_njrat_satacom

IMPHASH 9fc8267bbf7bffff09f3f4545c6fdd0c
SHA256 658a4b4a4dc3b5c4f4f60db15927a9accea224fb8fdbff85a6bac403e48591aa
MD5 9608194289a7859347ceb06a72532927
SHA1 c62b71a2cce85e727e3d0d383d23faafc95262da
SHA512 7628ff5396325c780cbc280f44ec29a3e8d4d6468c903d1d733edd1b7742c1229005a70d7b30c140804673cb0760236dd5368d806678868054cd5679c029a01b
SSDEEP 49152:ZKagaeoBzaXmlffKnSDWL6xyqUe/FqVHQxmAevlDhXwu:ZKagalrlf2vL6Mk8VMmbr
TLSH
T1BBA5E056A3A800F8D077C274CA565607EBB2F806273497CF53948D5A6F23BB25E7E321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1997776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey GetUserNameA

user32

ReleaseDC GetSystemMetrics GetDC

wininet

InternetOpenUrlA InternetReadFile InternetCloseHandle InternetOpenA InternetSetOptionA

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpConnect

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteDC DeleteObject BitBlt

gdiplus

GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdipGetImageEncodersSize GdiplusStartup GdipSaveImageToFile

crypt32

CryptBinaryToStringA

kernel32

GetACP IsValidCodePage ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetOEMCP LCMapStringW CompareStringW WriteConsoleW GetDateFormatW LoadLibraryExW VirtualProtect GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetLocaleInfoW SetEnvironmentVariableW GetConsoleMode GetConsoleOutputCP GetTimeZoneInformation GetFileType SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetTimeFormatW LocalFree GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle GetTempPathW Sleep CloseHandle GlobalMemoryStatusEx SetConsoleOutputCP GetComputerNameA ExpandEnvironmentStringsW WaitForSingleObject ReadFile SetFilePointer CreateFileW GetLastError CreateProcessW WriteFile CreateNamedPipeW PeekNamedPipe GetCurrentThreadId GetCurrentProcessId WideCharToMultiByte GetTickCount ConnectNamedPipe GetModuleHandleW AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc RaiseException GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile RtlUnwind LockFileEx GetFileSize DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter FlushFileBuffers GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW SetFileInformationByHandle CreateFile2 GetProcAddress GetFileInformationByHandleEx QueryPerformanceFrequency GetSystemTimePreciseAsFileTime InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead GetModuleFileNameW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_9608194289a7859347ceb06a72532927_cobalt-strike_icedid_njrat_satacom

version

advapi32

user32

wininet

winhttp

gdi32

gdiplus

crypt32

kernel32

generic