2026-10-28_45881b76767c8121afd4a8d94c5b06ca_cobalt-strike_icedid_ngrbot_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_45881b76767c8121afd4a8d94c5b06ca_cobalt-strike_icedid_ngrbot_njrat_satacom_stealc
Size 465KB
Sample261030-gd67rawshv
SHA256 3897b2b09b741d0c48331c62e0db95c064a2ad3ceddc4d184be52168f3aaced3
MD5 45881b76767c8121afd4a8d94c5b06ca
SHA1 5b4bf9597d4c6eca8bfb9851d59587be205c3567
SHA512 11213af739530239fe0d5ededaa7e13176f27e9f916bc1d1ab3c293803b346e4c432e4a10ba1e3671c56b435112e67d147f92dcdeb593af6c64b85a18a8aafcb
SSDEEP 6144://PST3wfayNc9oSxz083xjIapzb/2OYcdOJUS9hrUfMJu6BLT2mnT575tbWAj1wZ:nmgAXhpzq+KFOPyISQVXIq
TLSH
T1FFA45B26D69801BDE173D2B89E275807E77678460334AEDB03D0A9B61F175D88F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_45881b76767c8121afd4a8d94c5b06ca_cobalt-strike_icedid_ngrbot_njrat_satacom_stealc

File Explorer

2026-10-28_45881b76767c8121afd4a8d94c5b06ca_cobalt-strike_icedid_ngrbot_njrat_satacom_stealc

.exe 465KB

2026-10-28_45881b76767c8121afd4a8d94c5b06ca_cobalt-strike_icedid_ngrbot_njrat_satacom_stealc

IMPHASH 77166f419cd9eb19172685ee3788e394
SHA256 3897b2b09b741d0c48331c62e0db95c064a2ad3ceddc4d184be52168f3aaced3
MD5 45881b76767c8121afd4a8d94c5b06ca
SHA1 5b4bf9597d4c6eca8bfb9851d59587be205c3567
SHA512 11213af739530239fe0d5ededaa7e13176f27e9f916bc1d1ab3c293803b346e4c432e4a10ba1e3671c56b435112e67d147f92dcdeb593af6c64b85a18a8aafcb
SSDEEP 6144://PST3wfayNc9oSxz083xjIapzb/2OYcdOJUS9hrUfMJu6BLT2mnT575tbWAj1wZ:nmgAXhpzq+KFOPyISQVXIq
TLSH
T1FFA45B26D69801BDE173D2B89E275807E77678460334AEDB03D0A9B61F175D88F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

248816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom

crypt32

CryptUnprotectData

shell32

ord680

advapi32

RegCloseKey RegOpenKeyExW RegCreateKeyExW GetUserNameW RegSetValueExW RegQueryValueExW

gdi32

CreateCompatibleDC BitBlt DeleteDC DeleteObject SelectObject GetDIBits CreateCompatibleBitmap

user32

ShowWindow OpenClipboard CloseClipboard SetClipboardData GetClipboardData EmptyClipboard GetKeyState GetAsyncKeyState GetKeyboardState ToUnicode GetLastInputInfo GetSystemMetrics GetForegroundWindow CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindowTextW ReleaseDC GetDC

wininet

InternetOpenW InternetCloseHandle InternetConnectW InternetReadFile InternetSetOptionW HttpOpenRequestW HttpSendRequestW HttpQueryInfoW

ole32

CoTaskMemFree CoCreateInstance CoInitializeEx CoSetProxyBlanket

oleaut32

VariantClear VariantInit

kernel32

SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc WriteConsoleW GetModuleFileNameW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW LoadLibraryExW GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetEnvironmentVariableW ExpandEnvironmentStringsW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx ReadFile RemoveDirectoryW SetFileAttributesW SetFilePointerEx WriteFile GetTempPathW GetVolumeInformationA CloseHandle SetHandleInformation GetLastError CreatePipe WaitForSingleObject CreateMutexW Sleep TerminateProcess ResumeThread CreateProcessW GetThreadContext SetThreadContext GlobalMemoryStatusEx GetTickCount GetTickCount64 GetSystemDirectoryW GetNativeSystemInfo VirtualAlloc VirtualProtect VirtualAllocEx WriteProcessMemory FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryW GlobalAlloc GlobalUnlock GlobalLock LocalFree CopyFileW MoveFileW GetComputerNameW GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetModuleHandleExW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CreateThread ExitThread FreeLibraryAndExitThread

Name

.text

Size

348KB

Virtual Size

348KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

856B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_45881b76767c8121afd4a8d94c5b06ca_cobalt-strike_icedid_ngrbot_njrat_satacom_stealc

bcrypt

crypt32

shell32

advapi32

gdi32

user32

wininet

ole32

oleaut32

kernel32

generic