2026-11-01_e83ba82aa1e4fe2b7c32f2b332fda9f6_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_e83ba82aa1e4fe2b7c32f2b332fda9f6_cobalt-strike_icedid_njrat_satacom_stealc
Size 2.8MB
Sample261102-ffsayazzcx
SHA256 12fea5969149eb61b67717b8c3fb06d4c61bad57ac50dac5c89bfe5970d3d40f
MD5 e83ba82aa1e4fe2b7c32f2b332fda9f6
SHA1 1dc7bc9bf37cb21c06642d143713e99e51750f79
SHA512 4ec5ae8ddb87da8d66c72f09afae1e942fe8a4aeea784bc4549ff3c6f91f496fce88d481663546c7de074f646b54129ec10ec96799dc0c95556a0693e6fcac97
SSDEEP 49152:c9Kb6xUdc3yv7n217FNAD0FHUneTuc3S5/t7Ku8tPmT7pyjaB3qIeQigBHJ4:khtNADJneqci5/g7teByQ3b3igl6
TLSH
T150D50248F2F900F9F2679538C9A6691BD77678510B204ADF13A5456A3F337E00BB7B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_e83ba82aa1e4fe2b7c32f2b332fda9f6_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-11-01_e83ba82aa1e4fe2b7c32f2b332fda9f6_cobalt-strike_icedid_njrat_satacom_stealc

.exe 2.8MB

2026-11-01_e83ba82aa1e4fe2b7c32f2b332fda9f6_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 482097c8d94aeb77b2122a61e33f4b34
SHA256 12fea5969149eb61b67717b8c3fb06d4c61bad57ac50dac5c89bfe5970d3d40f
MD5 e83ba82aa1e4fe2b7c32f2b332fda9f6
SHA1 1dc7bc9bf37cb21c06642d143713e99e51750f79
SHA512 4ec5ae8ddb87da8d66c72f09afae1e942fe8a4aeea784bc4549ff3c6f91f496fce88d481663546c7de074f646b54129ec10ec96799dc0c95556a0693e6fcac97
SSDEEP 49152:c9Kb6xUdc3yv7n217FNAD0FHUneTuc3S5/t7Ku8tPmT7pyjaB3qIeQigBHJ4:khtNADJneqci5/g7teByQ3b3igl6
TLSH
T150D50248F2F900F9F2679538C9A6691BD77678510B204ADF13A5456A3F337E00BB7B22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

443088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice

dcomp

DCompositionCreateDevice

user32

UnregisterClassW RegisterClassExW DispatchMessageA TranslateMessage PostQuitMessage PeekMessageA SetClipboardData CreateWindowExW ScreenToClient ClientToScreen SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData DestroyWindow CloseClipboard OpenClipboard SetProcessDPIAware SystemParametersInfoA EnumDisplaySettingsA ChangeDisplaySettingsExA LoadCursorA GetCursorPos MessageBoxW GetWindowRect ReleaseDC GetDC UpdateWindow GetSystemMetrics SetWindowPos ShowWindow DefWindowProcA

gdi32

GetDeviceCaps

shell32

SHGetFolderPathA ShellExecuteW ShellExecuteA

winmm

timeEndPeriod timeBeginPeriod

advapi32

RegSetValueExA RegCreateKeyExA RegDeleteValueA RegEnumKeyA RegQueryValueExA RegOpenKeyExA RegCloseKey

kernel32

OutputDebugStringW ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext HeapReAlloc HeapAlloc HeapFree WriteFile TerminateProcess WriteConsoleW IsValidCodePage GetACP GetOEMCP GetModuleHandleExW GetModuleFileNameW GetFileType GetStdHandle ReadFile FlsFree FlsSetValue GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle CreateFileW HeapSize GetFileAttributesA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle QueryPerformanceCounter QueryPerformanceFrequency GetCurrentProcess ExitProcess CreateProcessA GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource LoadLibraryW FindResourceA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte FreeLibrary LoadLibraryA GetLocaleInfoA EnterCriticalSection LeaveCriticalSection RtlUnwind DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead FlsGetValue FindClose FindFirstFileExW FindNextFileW DeleteFileA GetCommandLineA FlsAlloc SetLastError GetLastError SetEndOfFile InitializeCriticalSectionEx RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx

imm32

ImmSetCandidateWindow ImmGetContext ImmReleaseContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

625KB

Virtual Size

624KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

186KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CRT

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_e83ba82aa1e4fe2b7c32f2b332fda9f6_cobalt-strike_icedid_njrat_satacom_stealc

d3d11

dcomp

user32

gdi32

shell32

winmm

advapi32

kernel32

imm32

d3dcompiler_47

generic