2026-11-01_9bbc6c59886a1f68d15ee718f54d305d_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_9bbc6c59886a1f68d15ee718f54d305d_cobalt-strike_icedid_njrat_satacom_stealc
Size 3.6MB
Sample261102-q2gfnstyh1
SHA256 0ce481c14be9bb951857227b781ec7e05d99e3e51fe297b13ec315a5808eef35
MD5 9bbc6c59886a1f68d15ee718f54d305d
SHA1 6930a82903950ee2849c63864d367c230392d44a
SHA512 863b236fecae2728460ca7a7d747fa7c1652f03fd6e46a3a389b2758dfe49f64908bc3ce1e563e71a32f48390e16009217bbd52eb511239ad531a232e65ddc61
SSDEEP 49152:o66vuqSmJV9okmiFco6Sfxs1xA9hNOnYT8+HE8QIMvAs8pWy4y3VLuxPNyA+2dm4:YvMuevARjVqxDmGTZ
TLSH
T17706E046E29742A8EF726B3884956327C2B03CD547B097E31BDC49645FB3AF42A7E740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_9bbc6c59886a1f68d15ee718f54d305d_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-11-01_9bbc6c59886a1f68d15ee718f54d305d_cobalt-strike_icedid_njrat_satacom_stealc

.exe 3.6MB

2026-11-01_9bbc6c59886a1f68d15ee718f54d305d_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 0bb25865836e59f76ca7a659578ae60c
SHA256 0ce481c14be9bb951857227b781ec7e05d99e3e51fe297b13ec315a5808eef35
MD5 9bbc6c59886a1f68d15ee718f54d305d
SHA1 6930a82903950ee2849c63864d367c230392d44a
SHA512 863b236fecae2728460ca7a7d747fa7c1652f03fd6e46a3a389b2758dfe49f64908bc3ce1e563e71a32f48390e16009217bbd52eb511239ad531a232e65ddc61
SSDEEP 49152:o66vuqSmJV9okmiFco6Sfxs1xA9hNOnYT8+HE8QIMvAs8pWy4y3VLuxPNyA+2dm4:YvMuevARjVqxDmGTZ
TLSH
T17706E046E29742A8EF726B3884956327C2B03CD547B097E31BDC49645FB3AF42A7E740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

898032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA CreateFileA ReadFile WriteFile CloseHandle PeekNamedPipe GetCurrentProcessId ExitProcess CreateProcessW GetModuleFileNameW GetModuleHandleW WaitForSingleObject GetExitCodeProcess GetExitCodeThread VirtualAllocEx ReadProcessMemory WriteProcessMemory VirtualFreeEx GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage VerSetConditionMask SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle TerminateProcess GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GlobalAlloc GetTickCount64 HeapSize WriteConsoleW SetEndOfFile GetFileSizeEx RtlUnwind CreateFileW SetStdHandle GetProcessHeap CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc FreeEnvironmentStringsW GetLastError WaitForSingleObjectEx Sleep GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx RtlLookupFunctionEntry SetLastError GetEnvironmentStringsW

user32

TranslateMessage DispatchMessageW PeekMessageW GetAsyncKeyState EnumDisplayMonitors GetMonitorInfoW MapWindowPoints UpdateWindow MoveWindow SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW DefWindowProcW SetWindowLongW SetForegroundWindow SetProcessDPIAware MonitorFromWindow LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseDC GetDC GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard

gdi32

DeleteObject GetDeviceCaps CreateSolidBrush CreateRectRgn

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea DwmEnableBlurBehindWindow DwmIsCompositionEnabled DwmGetColorizationColor

wininet

InternetCloseHandle InternetOpenUrlA InternetReadFile InternetSetOptionA InternetOpenA

Name

.text

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_9bbc6c59886a1f68d15ee718f54d305d_cobalt-strike_icedid_njrat_satacom_stealc

d3dx11_43

d3d11

kernel32

user32

gdi32

imm32

d3dcompiler_47

dwmapi

wininet

generic