2026-10-26_5996718f053f7f611afd79421e803a87_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_5996718f053f7f611afd79421e803a87_cobalt-strike_icedid_njrat_satacom_stealc
Size 57.3MB
Sample261027-t9mt7ss18k
SHA256 f695a3f5d41afe20e475cda207a1574d899e5b145a4ea302ca4937fecd02e13b
MD5 5996718f053f7f611afd79421e803a87
SHA1 95540c55099ecc43f4912ce60749c32f33e212b7
SHA512 66711405bdf4d887242824f31864ea14b4f671a9854a80f231768f20709c57da1469ca46867d817d5e900a2940911c7529ae05d827868465fedb9921cf7ad6a7
SSDEEP 1572864:aQZAXxcLifFgIOQTQtApMqiGn5QG4lMVrQukca/FKVe:akqcIFpfwn/ErYca/FK
TLSH
T1DBD73370DCC421B5C2B7C57A53D3815AE1B3118A16A3EE9F26B19901AF138C52F6B39F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_5996718f053f7f611afd79421e803a87_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-26_5996718f053f7f611afd79421e803a87_cobalt-strike_icedid_njrat_satacom_stealc

.exe 57.3MB

2026-10-26_5996718f053f7f611afd79421e803a87_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 6fa4a8ca5af96b3cef124171b1db123a
SHA256 f695a3f5d41afe20e475cda207a1574d899e5b145a4ea302ca4937fecd02e13b
MD5 5996718f053f7f611afd79421e803a87
SHA1 95540c55099ecc43f4912ce60749c32f33e212b7
SHA512 66711405bdf4d887242824f31864ea14b4f671a9854a80f231768f20709c57da1469ca46867d817d5e900a2940911c7529ae05d827868465fedb9921cf7ad6a7
SSDEEP 1572864:aQZAXxcLifFgIOQTQtApMqiGn5QG4lMVrQukca/FKVe:akqcIFpfwn/ErYca/FK
TLSH
T1DBD73370DCC421B5C2B7C57A53D3815AE1B3118A16A3EE9F26B19901AF138C52F6B39F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

97120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\Launcher\NetkubLauncher\NetkubLauncherFUll\x64\Release\NetkubLauncher.pdb

kernel32

GlobalLock MoveFileExW DeleteCriticalSection ExitProcess GetCurrentProcessId CreateProcessW GetModuleHandleW WideCharToMultiByte Module32NextW QueryFullProcessImageNameW QueryPerformanceCounter GlobalUnlock IsDebuggerPresent CheckRemoteDebuggerPresent WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetProcAddress SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA OpenProcess GetACP IsValidCodePage GetStringTypeW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW InitializeCriticalSectionAndSpinCount GetTimeZoneInformation GetFileType GetThreadContext Module32FirstW FindResourceW LoadResource CreateThread CloseHandle Process32FirstW DeleteFileW GlobalAlloc LockResource GetCurrentThread Process32NextW MultiByteToWideChar Sleep GetProcessHeap CreateToolhelp32Snapshot GetModuleHandleA CreateFileW WaitForSingleObject GetTempPathW GetEnvironmentVariableW InitializeCriticalSection LeaveCriticalSection GetModuleFileNameW TerminateProcess WriteFile GetCurrentProcess EnterCriticalSection GetLogicalDrives GetVolumeInformationW SizeofResource HeapAlloc HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetStdHandle IsProcessorFeaturePresent GetCPInfo GetModuleHandleExW FreeLibrary InitializeCriticalSectionEx EncodePointer FlsFree ReadFile GetOEMCP CreateDirectoryW FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx GetLastError AreFileApisANSI CreateFile2 SetFileInformationByHandle LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW

user32

BeginPaint InvalidateRect ReleaseCapture UpdateWindow RegisterWindowMessageW PostQuitMessage DrawTextW GetClientRect SetCursor SetClipboardData LoadCursorW LoadIconW TranslateMessage EndPaint RegisterClassW EmptyClipboard CloseClipboard SetTimer DispatchMessageW OpenClipboard ShowWindow SetWindowTextW GetSystemMetrics SendMessageW CreateWindowExW FillRect MessageBoxW PostMessageW DefWindowProcW GetMessageW GetWindowTextW TrackMouseEvent

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateFontW DeleteDC TextOutW GetTextExtentPoint32W SetTextColor SetBkMode SetBkColor DeleteObject CreateSolidBrush

comdlg32

GetOpenFileNameW

advapi32

CryptCreateHash RegQueryValueExW CryptGetHashParam CryptDestroyKey CryptVerifySignatureA CryptAcquireContextA RegCloseKey CryptGenRandom CryptReleaseContext CryptHashData CryptSetHashParam CryptDestroyHash RegOpenKeyExW CryptImportKey

shell32

ShellExecuteW

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpOpen WinHttpReceiveResponse WinHttpQueryHeaders

comctl32

ord410 ord413

gdiplus

GdipCreatePen1 GdipDeletePen GdipGetImageWidth GdipDeleteGraphics GdipAddPathArc GdipCloneBrush GdipSetTextRenderingHint GdipFillEllipseI GdipCreateFromHDC GdipDrawPath GdipFree GdipDrawArcI GdipClosePathFigure GdipFillRectangle GdipCloneBitmapAreaI GdipFillPath GdipCreateSolidFill GdipCreatePath GdipSetSmoothingMode GdipCreateLineBrushFromRect GdipDisposeImage GdipDeletePath GdipDrawImageRectI GdipAlloc GdipCreateBitmapFromStream GdipDeleteBrush GdipCloneImage GdipGetImageHeight GdiplusShutdown GdiplusStartup GdipDrawLineI

shlwapi

ord12

Name

.text

Size

233KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.M<M

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

52.9MB

Virtual Size

52.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_5996718f053f7f611afd79421e803a87_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

gdi32

comdlg32

advapi32

shell32

winhttp

comctl32

gdiplus

shlwapi

generic