2026-10-28_6601ad9cd30604168d190f527d2ba521_cobalt-strike_icedid_njrat_remcos_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_6601ad9cd30604168d190f527d2ba521_cobalt-strike_icedid_njrat_remcos_satacom_stealc
Size 6.7MB
Sample261030-dkqlssvxev
SHA256 86236981cd7bce9e8c0becabf8b283116e6dd3b01a53d54c2f04f1aba809566e
MD5 6601ad9cd30604168d190f527d2ba521
SHA1 51d5d7ded5c584565680189d4f40d54c374ab529
SHA512 fa05bdee74d1db7110c06285447e2557ce737a18f52a2f30293d7dce865a4e8bec5ae2d677d7d2887284a1a03c06cca52fbe969155b601b39d2e330aa4ecf503
SSDEEP 196608:9jmzYByDMwK3SH9ot+VVUqQIpi9h+z8oT6mQ:9mBwSH9yxX4znO1
TLSH
T131660292A3F406ACD1B2D3B8AA766516DA36B847073095DB32C845171F379E4CE3BB31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_6601ad9cd30604168d190f527d2ba521_cobalt-strike_icedid_njrat_remcos_satacom_stealc

File Explorer

2026-10-28_6601ad9cd30604168d190f527d2ba521_cobalt-strike_icedid_njrat_remcos_satacom_stealc

.exe 6.7MB

2026-10-28_6601ad9cd30604168d190f527d2ba521_cobalt-strike_icedid_njrat_remcos_satacom_stealc

IMPHASH aee55743544c5a79810da81764f3d7a7
SHA256 86236981cd7bce9e8c0becabf8b283116e6dd3b01a53d54c2f04f1aba809566e
MD5 6601ad9cd30604168d190f527d2ba521
SHA1 51d5d7ded5c584565680189d4f40d54c374ab529
SHA512 fa05bdee74d1db7110c06285447e2557ce737a18f52a2f30293d7dce865a4e8bec5ae2d677d7d2887284a1a03c06cca52fbe969155b601b39d2e330aa4ecf503
SSDEEP 196608:9jmzYByDMwK3SH9ot+VVUqQIpi9h+z8oT6mQ:9mBwSH9yxX4znO1
TLSH
T131660292A3F406ACD1B2D3B8AA766516DA36B847073095DB32C845171F379E4CE3BB31
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

815344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

MulDiv CreateDirectoryW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx GetFullPathNameW ReadFile SetFilePointerEx FormatMessageW AreFileApisANSI CompareStringW GetCPInfo IsDBCSLeadByte SetLastError Sleep GetProcAddress FileTimeToLocalFileTime LocalFileTimeToFileTime GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime GetCurrentDirectoryW FoldStringW GetLocaleInfoW CreateEventW GetCurrentProcess SetThreadPriority GetSystemDirectoryW SetThreadExecutionState GetVersionExW SetFileTime MoveFileW GetFileType SetEndOfFile SetFilePointer GetConsoleMode GetLongPathNameW GetShortPathNameW CreateHardLinkW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateSemaphoreW CreateThread GetProcessAffinityMask WriteConsoleW HeapSize GetConsoleOutputCP GetProcessHeap GlobalLock GetEnvironmentStringsW GetCommandLineA FindFirstFileExW GetOEMCP GetACP IsValidCodePage SetStdHandle HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent TerminateProcess ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW CompareStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW GetLogicalProcessorInformationEx GetExitCodeThread WaitForSingleObjectEx QueryPerformanceFrequency QueryPerformanceCounter RaiseException RtlPcToFileHeader SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockExclusive GlobalUnlock GlobalAlloc LoadLibraryW FreeLibrary TrySubmitThreadpoolCallback CallbackMayRunLong GetDiskFreeSpaceExW LCMapStringEx GetUserDefaultUILanguage LCIDToLocaleName MoveFileExW EnumResourceLanguagesW GlobalFree EnumResourceNamesW GetLocalTime GetCurrentProcessId GetTempPathW FlushFileBuffers MultiByteToWideChar SetConsoleCtrlHandler AttachConsole LocalFree SizeofResource LockResource LoadResource GetModuleHandleW GetModuleFileNameW FindResourceExW GetTickCount64 SetUnhandledExceptionFilter WriteFile GetCommandLineW GetStdHandle WideCharToMultiByte GetFileInformationByHandleEx SetFileAttributesW RemoveDirectoryW GetFileInformationByHandle GetFileAttributesExW DeleteFileW CompareStringOrdinal DeviceIoControl GetLastError CloseHandle GetVolumeNameForVolumeMountPointW GetVolumePathNameW FreeEnvironmentStringsW CreateFileW

user32

OemToCharBuffA MessageBoxW IsWindow RegisterWindowMessageW TrackMouseEvent OemToCharA CharToOemBuffW GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW DefWindowProcW CharToOemA CreateWindowExW IsChild DestroyWindow ShowWindow SetLayeredWindowAttributes FlashWindowEx NotifyWinEvent GetMonitorInfoW SetWindowPos IsWindowVisible IsIconic GetDlgCtrlID MonitorFromWindow DrawIconEx LoadImageW DestroyIcon GetScrollBarInfo SystemParametersInfoW GetScrollInfo SetScrollInfo IsDialogMessageW LoadIconW CharUpperW RegisterClassExW CharLowerW OpenClipboard CloseClipboard PostQuitMessage OffsetRect GetWindow GetWindowThreadProcessId GetClassNameW GetParent SetWindowLongPtrW GetWindowLongPtrW PtInRect EqualRect LoadCursorW IntersectRect FillRect ChildWindowFromPointEx MapWindowPoints ScreenToClient ClientToScreen GetCursorPos SetCursor GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RedrawWindow ValidateRect InvalidateRect SetWindowRgn EndPaint BeginPaint ReleaseDC GetWindowDC GetDC GetForegroundWindow UpdateWindow DrawTextW TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu GetSystemMetrics IsWindowEnabled EnableWindow KillTimer SetTimer ReleaseCapture SetCapture GetCapture GetKeyState GetFocus SetFocus EmptyClipboard SetClipboardData

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership FreeSid LookupPrivilegeValueW RegGetValueW OpenProcessToken SetFileSecurityW

gdi32

RoundRect SelectObject SetBkColor CreateCompatibleDC GetTextMetricsW CreateDIBSection GdiFlush BitBlt CreateCompatibleBitmap CombineRgn SetTextColor CreateFontW CreateRectRgn CreateRoundRectRgn CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps GetStockObject GetRgnBox

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteExW

ole32

CoTaskMemFree CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

VariantInit

uxtheme

SetWindowTheme

dwmapi

DwmSetWindowAttribute DwmFlush

bcrypt

BCryptDestroyHash BCryptGetProperty BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptDeriveKeyPBKDF2 BCryptOpenAlgorithmProvider

crypt32

CryptStringToBinaryW

xmllite

CreateXmlReader

d2d1

ord1

dwrite

DWriteCreateFactory

comctl32

InitCommonControlsEx ImageList_Create ImageList_Destroy ord410 ord411 ord412 ord413

shlwapi

UrlGetPartW ord12

winmm

mciSendStringW

Name

.text

Size

961KB

Virtual Size

960KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

237KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_6601ad9cd30604168d190f527d2ba521_cobalt-strike_icedid_njrat_remcos_satacom_stealc

kernel32

user32

advapi32

gdi32

shell32

ole32

oleaut32

uxtheme

dwmapi

bcrypt

crypt32

xmllite

d2d1

dwrite

comctl32

shlwapi

winmm

generic