2026-10-30_fe1a7ee41db645e298e6995804f3f46f_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_fe1a7ee41db645e298e6995804f3f46f_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.1MB
Sample261030-pbj87sed74
SHA256 5b8792f5a708691d0d53dd52fc7ef5798ab09f388d4a6e76163317e3f53d8950
MD5 fe1a7ee41db645e298e6995804f3f46f
SHA1 f47e304ebe0898257bcaa7847284faace085d429
SHA512 7c465659d6d349259678dc36b6835e30e6f6e10692676f01d0c440ad565737fc27975a80da03683ad3b49bf4e3e6ccfca7a31fd0d0d9fb7b46249945b9cb9492
SSDEEP 24576:GKsCqGxQb/HH9LlczQIOepipnSShdmau:rhQjH9GMIypnSK
TLSH
T1E3359D09E2A801F9D07BD178C962990BEB72784907349ADF13E049A91F77AE09F7F711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-30_fe1a7ee41db645e298e6995804f3f46f_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-30_fe1a7ee41db645e298e6995804f3f46f_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.1MB

2026-10-30_fe1a7ee41db645e298e6995804f3f46f_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 089334f523d9811d69f42df1cfdc3362
SHA256 5b8792f5a708691d0d53dd52fc7ef5798ab09f388d4a6e76163317e3f53d8950
MD5 fe1a7ee41db645e298e6995804f3f46f
SHA1 f47e304ebe0898257bcaa7847284faace085d429
SHA512 7c465659d6d349259678dc36b6835e30e6f6e10692676f01d0c440ad565737fc27975a80da03683ad3b49bf4e3e6ccfca7a31fd0d0d9fb7b46249945b9cb9492
SSDEEP 24576:GKsCqGxQb/HH9LlczQIOepipnSShdmau:rhQjH9GMIypnSK
TLSH
T1E3359D09E2A801F9D07BD178C962990BEB72784907349ADF13E049A91F77AE09F7F711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

506784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea DwmFlush

winmm

timeEndPeriod timeBeginPeriod

kernel32

SetProcessMitigationPolicy CreateToolhelp32Snapshot CreateEventW MultiByteToWideChar ProcessIdToSessionId Sleep GetConsoleMode GetTickCount64 GetLastError Process32NextW SetEvent LockResource DeleteFileW Process32FirstW CloseHandle FreeConsole CreateThread LoadResource FindResourceW GetLocalTime Beep GetProcAddress ExitProcess SetConsoleCP GetCurrentProcessId CreateProcessW GetModuleHandleW WideCharToMultiByte GetConsoleWindow QueryFullProcessImageNameW SetConsoleOutputCP AllocConsole SetConsoleTitleW GetProcessTimes GetExitCodeProcess ReadFile GetVolumeInformationW GetFileSizeEx GetCurrentThread GetThreadContext GetWindowsDirectoryW LocalFree MoveFileExW GetComputerNameW IsDebuggerPresent CheckRemoteDebuggerPresent InitOnceExecuteOnce EnterCriticalSection DeviceIoControl LeaveCriticalSection InitializeCriticalSection GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseMutex RtlCaptureStackBackTrace QueryPerformanceFrequency GetSystemTime QueryPerformanceCounter FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentThreadId GetCommandLineA FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetTimeZoneInformation GetFileType HeapAlloc HeapFree GetModuleHandleExW FreeLibrary IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwind CreateFileW WaitForSingleObject CreateMutexW GetTempPathW GetEnvironmentVariableW WaitForMultipleObjects GetModuleFileNameW TerminateProcess SetConsoleMode WriteFile GetStdHandle GetCurrentProcess SetConsoleTextAttribute RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx SetDefaultDllDirectories GetConsoleScreenBufferInfo SizeofResource SetEnvironmentVariableW GetProcessHeap SetStdHandle RaiseException RtlPcToFileHeader OpenProcess HeapSize WriteConsoleW SetEndOfFile GetCommandLineW

user32

IsIconic UpdateWindow SetProcessDPIAware EnumDisplaySettingsW PostQuitMessage GetWindowTextW LoadIconW SetLayeredWindowAttributes EnumWindows OpenClipboard ShowWindow GetWindowLongPtrW SendMessageW SetWindowLongPtrW MessageBoxW SetWindowPos GetWindowRect PostMessageW GetWindowThreadProcessId SetClipboardData GetCursorPos CloseClipboard EmptyClipboard PeekMessageW IsWindow GetWindowDisplayAffinity DefWindowProcW DestroyWindow IsWindowVisible CreateWindowExW GetSystemMetrics RegisterClassExW GetAsyncKeyState DispatchMessageW ClientToScreen GetClientRect SetWindowDisplayAffinity TranslateMessage LoadCursorW SetCursor GetClipboardData

advapi32

GetTokenInformation ConvertSidToStringSidW RegGetValueW OpenProcessToken SetFileSecurityW CryptReleaseContext CryptDestroyHash CryptHashData CryptCreateHash CryptVerifySignatureW CryptAcquireContextW CryptDestroyKey ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHGetKnownFolderPath ShellExecuteExW ShellExecuteW SHCreateDirectoryExW

ole32

CoTaskMemFree

bcrypt

BCryptDecrypt BCryptOpenAlgorithmProvider BCryptGenRandom BCryptEncrypt BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptSetProperty BCryptDestroyKey BCryptGenerateSymmetricKey BCryptFinishHash BCryptCreateHash

crypt32

CryptProtectData CryptDecodeObjectEx CryptStringToBinaryA CryptBinaryToStringA CryptImportPublicKeyInfo CryptUnprotectData

winhttp

WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpen

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

728KB

Virtual Size

727KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

181KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BRKSEAL

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_fe1a7ee41db645e298e6995804f3f46f_cobalt-strike_icedid_njrat_satacom_stealc

d3d11

d3dcompiler_47

dwmapi

winmm

kernel32

user32

advapi32

shell32

ole32

bcrypt

crypt32

winhttp

imm32

generic