2026-10-26_76cd198fbff1aa55296ad4e834d40bdf_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-10-26_76cd198fbff1aa55296ad4e834d40bdf_cobalt-strike_icedid_njrat_satacom_stealc
Size 318KB
Sample261027-rk66fast4m
SHA256 da3cfb5351a8fe231e2d01e4fc80f3fe8ccf327029de92231c59b3d59bdebbe0
MD5 76cd198fbff1aa55296ad4e834d40bdf
SHA1 70eaf707900a9ac0b7b9bda4f0c0b7f3e7d76aa5
SHA512 b17ff449e76142a88617927e2bb821f523c859038c466d37551d5f937daf641a441ea8a2137562d87743e25e8d30c667dfa99638b0e4b9fafc22aeb886d23f26
SSDEEP 6144:M8mC3CfTEE2Db8ORxYI0yP8pmza7IP58:fM7EE2DbpH0yUwza7W
TLSH
T18D648D15F6A910F9E577C27CC9424906EB727C524761E6CF23A04A9B2F23BE09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_76cd198fbff1aa55296ad4e834d40bdf_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-26_76cd198fbff1aa55296ad4e834d40bdf_cobalt-strike_icedid_njrat_satacom_stealc

.exe 318KB

2026-10-26_76cd198fbff1aa55296ad4e834d40bdf_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 21f4ae73e2875a72b57fc83a9369c7ad
SHA256 da3cfb5351a8fe231e2d01e4fc80f3fe8ccf327029de92231c59b3d59bdebbe0
MD5 76cd198fbff1aa55296ad4e834d40bdf
SHA1 70eaf707900a9ac0b7b9bda4f0c0b7f3e7d76aa5
SHA512 b17ff449e76142a88617927e2bb821f523c859038c466d37551d5f937daf641a441ea8a2137562d87743e25e8d30c667dfa99638b0e4b9fafc22aeb886d23f26
SSDEEP 6144:M8mC3CfTEE2Db8ORxYI0yP8pmza7IP58:fM7EE2DbpH0yUwza7W
TLSH
T18D648D15F6A910F9E577C27CC9424906EB727C524761E6CF23A04A9B2F23BE09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

81424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle GetLastError OpenProcess ReadProcessMemory LocalFree FormatMessageA CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW WriteConsoleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree GetFileType VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize CreateFileW RtlUnwind

Name

.text

Size

212KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_76cd198fbff1aa55296ad4e834d40bdf_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

generic