2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom

General

Target
2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom
Size 139KB
Sample261027-tpmcyaea36
SHA256 b9464d1eedf3532a7c4e1c2422f0dadeb738d2534156244ba392769a48cbd564
MD5 5f549587a92bdb66fc23d9de1dfc106d
SHA1 18d748a7e7ed86f1257b3f6bb813164f077df762
SHA512 09f5cc1d39e36e48aa764b015d0a79b888bbf4e0331a10aa0dfc55d4a3d511de75dc1bb97a31409fa43291950591ee1e558c10dc8ecdd8e62969966dfe5989fb
SSDEEP 3072:XnvrR8tkNgkxBhpsSyig8sBoxvpxYBXUY6+WSvm:XTDNgkxWSy/k4G
TLSH
T1B7D36C46ABE531F9E17B8678C4A20A16D772F83647719FEF07A042561F237D08E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom

File Explorer

2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom

.exe 139KB

2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom

IMPHASH 98acfa23de8cb5c5f42d3a71d2fbefe4
SHA256 b9464d1eedf3532a7c4e1c2422f0dadeb738d2534156244ba392769a48cbd564
MD5 5f549587a92bdb66fc23d9de1dfc106d
SHA1 18d748a7e7ed86f1257b3f6bb813164f077df762
SHA512 09f5cc1d39e36e48aa764b015d0a79b888bbf4e0331a10aa0dfc55d4a3d511de75dc1bb97a31409fa43291950591ee1e558c10dc8ecdd8e62969966dfe5989fb
SSDEEP 3072:XnvrR8tkNgkxBhpsSyig8sBoxvpxYBXUY6+WSvm:XTDNgkxWSy/k4G
TLSH
T1B7D36C46ABE531F9E17B8678C4A20A16D772F83647719FEF07A042561F237D08E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

116736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHGetFolderPathW SHFileOperationW

user32

wsprintfW MessageBoxW

kernel32

RtlCaptureContext WriteConsoleW CreateFileW SetFilePointerEx GetFileAttributesW CloseHandle WaitForSingleObject TerminateProcess OpenProcess lstrcpynW lstrcatW CreateToolhelp32Snapshot Process32FirstW Process32NextW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Name

.text

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

39KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_5f549587a92bdb66fc23d9de1dfc106d_cobalt-strike_icedid_satacom

shell32

user32

kernel32

generic