2026-11-02_cb2641dfd8ca2c515ebb2bf11c6f5373_cobalt-strike_icedid_njrat_remcos_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_cb2641dfd8ca2c515ebb2bf11c6f5373_cobalt-strike_icedid_njrat_remcos_satacom_stealc
Size 14.3MB
Sample261102-2lc9vsdw5y
SHA256 f23164c63fdf67419909523e4bce6b12e2e504e9055553967dd502a9e7c21036
MD5 cb2641dfd8ca2c515ebb2bf11c6f5373
SHA1 8a2726a392e5291216407ea32aa99880e0883bb1
SHA512 4daa3e3b66ec8bd18eb34706a59b7a792d9f49c893c0abecffad4863baf20ec2830fe38f2efdba968ed2325aef65ec559dd819ec008c079ba3b3a1b52beeb115
SSDEEP 196608:jYmzYByDMwK3SH9ot+VVUqQIpi9h+z8idkYGF1:UmBwSH9yxX4zgYGF
TLSH
T1DDE63FE7D0E87B2D54B14AFD3AB97923DE6E21236A64418839CD05136FF28F04D678D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_cb2641dfd8ca2c515ebb2bf11c6f5373_cobalt-strike_icedid_njrat_remcos_satacom_stealc

File Explorer

2026-11-02_cb2641dfd8ca2c515ebb2bf11c6f5373_cobalt-strike_icedid_njrat_remcos_satacom_stealc

.exe 14.3MB

2026-11-02_cb2641dfd8ca2c515ebb2bf11c6f5373_cobalt-strike_icedid_njrat_remcos_satacom_stealc

IMPHASH aee55743544c5a79810da81764f3d7a7
SHA256 f23164c63fdf67419909523e4bce6b12e2e504e9055553967dd502a9e7c21036
MD5 cb2641dfd8ca2c515ebb2bf11c6f5373
SHA1 8a2726a392e5291216407ea32aa99880e0883bb1
SHA512 4daa3e3b66ec8bd18eb34706a59b7a792d9f49c893c0abecffad4863baf20ec2830fe38f2efdba968ed2325aef65ec559dd819ec008c079ba3b3a1b52beeb115
SSDEEP 196608:jYmzYByDMwK3SH9ot+VVUqQIpi9h+z8idkYGF1:UmBwSH9yxX4zgYGF
TLSH
T1DDE63FE7D0E87B2D54B14AFD3AB97923DE6E21236A64418839CD05136FF28F04D678D8
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing possible sandbox analysis VM usernames
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

815344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

MulDiv CreateDirectoryW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx GetFullPathNameW ReadFile SetFilePointerEx FormatMessageW AreFileApisANSI CompareStringW GetCPInfo IsDBCSLeadByte SetLastError Sleep GetProcAddress FileTimeToLocalFileTime LocalFileTimeToFileTime GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime FileTimeToSystemTime SystemTimeToFileTime GetCurrentDirectoryW FoldStringW GetLocaleInfoW CreateEventW GetCurrentProcess SetThreadPriority GetSystemDirectoryW SetThreadExecutionState GetVersionExW SetFileTime MoveFileW GetFileType SetEndOfFile SetFilePointer GetConsoleMode GetLongPathNameW GetShortPathNameW CreateHardLinkW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateSemaphoreW CreateThread GetProcessAffinityMask WriteConsoleW HeapSize GetConsoleOutputCP GetProcessHeap GlobalLock GetEnvironmentStringsW GetCommandLineA FindFirstFileExW GetOEMCP GetACP IsValidCodePage SetStdHandle HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent TerminateProcess ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW CompareStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW GetLogicalProcessorInformationEx GetExitCodeThread WaitForSingleObjectEx QueryPerformanceFrequency QueryPerformanceCounter RaiseException RtlPcToFileHeader SleepConditionVariableSRW WakeAllConditionVariable WakeConditionVariable GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockExclusive GlobalUnlock GlobalAlloc LoadLibraryW FreeLibrary TrySubmitThreadpoolCallback CallbackMayRunLong GetDiskFreeSpaceExW LCMapStringEx GetUserDefaultUILanguage LCIDToLocaleName MoveFileExW EnumResourceLanguagesW GlobalFree EnumResourceNamesW GetLocalTime GetCurrentProcessId GetTempPathW FlushFileBuffers MultiByteToWideChar SetConsoleCtrlHandler AttachConsole LocalFree SizeofResource LockResource LoadResource GetModuleHandleW GetModuleFileNameW FindResourceExW GetTickCount64 SetUnhandledExceptionFilter WriteFile GetCommandLineW GetStdHandle WideCharToMultiByte GetFileInformationByHandleEx SetFileAttributesW RemoveDirectoryW GetFileInformationByHandle GetFileAttributesExW DeleteFileW CompareStringOrdinal DeviceIoControl GetLastError CloseHandle GetVolumeNameForVolumeMountPointW GetVolumePathNameW FreeEnvironmentStringsW CreateFileW

user32

OemToCharBuffA MessageBoxW IsWindow RegisterWindowMessageW TrackMouseEvent OemToCharA CharToOemBuffW GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW DefWindowProcW CharToOemA CreateWindowExW IsChild DestroyWindow ShowWindow SetLayeredWindowAttributes FlashWindowEx NotifyWinEvent GetMonitorInfoW SetWindowPos IsWindowVisible IsIconic GetDlgCtrlID MonitorFromWindow DrawIconEx LoadImageW DestroyIcon GetScrollBarInfo SystemParametersInfoW GetScrollInfo SetScrollInfo IsDialogMessageW LoadIconW CharUpperW RegisterClassExW CharLowerW OpenClipboard CloseClipboard PostQuitMessage OffsetRect GetWindow GetWindowThreadProcessId GetClassNameW GetParent SetWindowLongPtrW GetWindowLongPtrW PtInRect EqualRect LoadCursorW IntersectRect FillRect ChildWindowFromPointEx MapWindowPoints ScreenToClient ClientToScreen GetCursorPos SetCursor GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW RedrawWindow ValidateRect InvalidateRect SetWindowRgn EndPaint BeginPaint ReleaseDC GetWindowDC GetDC GetForegroundWindow UpdateWindow DrawTextW TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu GetSystemMetrics IsWindowEnabled EnableWindow KillTimer SetTimer ReleaseCapture SetCapture GetCapture GetKeyState GetFocus SetFocus EmptyClipboard SetClipboardData

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership FreeSid LookupPrivilegeValueW RegGetValueW OpenProcessToken SetFileSecurityW

gdi32

RoundRect SelectObject SetBkColor CreateCompatibleDC GetTextMetricsW CreateDIBSection GdiFlush BitBlt CreateCompatibleBitmap CombineRgn SetTextColor CreateFontW CreateRectRgn CreateRoundRectRgn CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps GetStockObject GetRgnBox

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteExW

ole32

CoTaskMemFree CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

VariantInit

uxtheme

SetWindowTheme

dwmapi

DwmSetWindowAttribute DwmFlush

bcrypt

BCryptDestroyHash BCryptGetProperty BCryptHashData BCryptCreateHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptDeriveKeyPBKDF2 BCryptOpenAlgorithmProvider

crypt32

CryptStringToBinaryW

xmllite

CreateXmlReader

d2d1

ord1

dwrite

DWriteCreateFactory

comctl32

InitCommonControlsEx ImageList_Create ImageList_Destroy ord410 ord411 ord412 ord413

shlwapi

UrlGetPartW ord12

winmm

mciSendStringW

Name

.text

Size

961KB

Virtual Size

960KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

237KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13.1MB

Virtual Size

13.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_cb2641dfd8ca2c515ebb2bf11c6f5373_cobalt-strike_icedid_njrat_remcos_satacom_stealc

kernel32

user32

advapi32

gdi32

shell32

ole32

oleaut32

uxtheme

dwmapi

bcrypt

crypt32

xmllite

d2d1

dwrite

comctl32

shlwapi

winmm

generic