2026-11-02_cb085de0ff94fb50826327d98294d235_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_cb085de0ff94fb50826327d98294d235_cobalt-strike_icedid_njrat_satacom_stealc
Size 308KB
Sample261102-2lxcqsgd95
SHA256 8a2ecdacd97c4d3317f768defb798885a73354adccd2032e030f9308dc4e8491
MD5 cb085de0ff94fb50826327d98294d235
SHA1 6881979cbf437413d6ec78e79306725cd51db38c
SHA512 2ef543a36af9278d90af75a9709c1d114110ebae3c729139865c586b28adc423f725986028a55c6dbdd48bb0bf130b97a380123a64809dcfc439d732dcd56a0c
SSDEEP 6144:yzR1Oge/Lbj4dx7mknqWw+qJkSXacOLAB:m+4d9qWwlfX8L
TLSH
T12D647B15F6A510FAEA67827CC9538906EB72BC164761EBCF03904A973F236D48E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_cb085de0ff94fb50826327d98294d235_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-11-02_cb085de0ff94fb50826327d98294d235_cobalt-strike_icedid_njrat_satacom_stealc

.exe 308KB

2026-11-02_cb085de0ff94fb50826327d98294d235_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH ca665f81c3795136d89239d615da724f
SHA256 8a2ecdacd97c4d3317f768defb798885a73354adccd2032e030f9308dc4e8491
MD5 cb085de0ff94fb50826327d98294d235
SHA1 6881979cbf437413d6ec78e79306725cd51db38c
SHA512 2ef543a36af9278d90af75a9709c1d114110ebae3c729139865c586b28adc423f725986028a55c6dbdd48bb0bf130b97a380123a64809dcfc439d732dcd56a0c
SSDEEP 6144:yzR1Oge/Lbj4dx7mknqWw+qJkSXacOLAB:m+4d9qWwlfX8L
TLSH
T12D647B15F6A510FAEA67827CC9538906EB72BC164761EBCF03904A973F236D48E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

PostQuitMessage RegisterClassW CreateWindowExW ShowWindow MoveWindow DrawTextW UpdateWindow BeginPaint EndPaint InvalidateRect SetWindowTextW DispatchMessageW GetClientRect AdjustWindowRect MessageBoxW SetCursor ClientToScreen ScreenToClient FillRect InflateRect GetParent LoadCursorW SetProcessDPIAware TranslateMessage GetMessageW TrackMouseEvent DefWindowProcW wsprintfW GetWindowTextW

gdi32

SetTextColor SetBkMode SelectObject RoundRect GetStockObject FillRgn DeleteObject CreateSolidBrush CreateRoundRectRgn CreatePen CreateFontW

comctl32

ord410 ord413 InitCommonControlsEx

comdlg32

GetOpenFileNameW GetSaveFileNameW

shell32

DragFinish DragAcceptFiles SHGetFolderPathW DragQueryFileW ShellExecuteExW

gdiplus

GdipDeleteBrush GdipCreateSolidFill GdipCloneImage GdipDisposeImage GdipCreateBitmapFromFile GdipAddPathArcI GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetInterpolationMode GdipFillRectangleI GdipFillPath GdipDrawImageRectI GdipClosePathFigure GdipDeletePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipFree GdipAlloc

bcrypt

BCryptEncrypt BCryptDecrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGenRandom BCryptDestroyKey

kernel32

GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP GetOEMCP GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile FlushFileBuffers SetFilePointerEx LCMapStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetProcAddress GetModuleHandleExW FreeLibrary TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError GetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW GetFileSizeEx ReadFile RtlUnwind WriteFile CloseHandle WaitForSingleObject GetModuleFileNameW GetModuleHandleW MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId

Name

.text

Size

203KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_cb085de0ff94fb50826327d98294d235_cobalt-strike_icedid_njrat_satacom_stealc

user32

gdi32

comctl32

comdlg32

shell32

gdiplus

bcrypt

kernel32

generic