2026-11-01_934a74d78c539ce323979fb51ef3f793_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_934a74d78c539ce323979fb51ef3f793_cobalt-strike_icedid_njrat_satacom_stealc
Size 683KB
Sample261102-r13syscy9q
SHA256 951d99d318f1b48c3987e8f5fbd6dca4a6f2757db92fc91313776e9cc54c31f1
MD5 934a74d78c539ce323979fb51ef3f793
SHA1 751adec25ad7d8d5a57e15ce567b97fd0732ef40
SHA512 3ce030c35d6c9f1cee7afd22a4bba5f4556b7f0b461e02ce73da75974f9d579eb0fc2e47ca584ea352115ef0b91ae576ca509a09f8a7ae1706c22fd7b7c51805
SSDEEP 12288:h+QDyjwvRptet19etOwreVvoJR7Qyi1W0vWE2c+0t:B98GtteVvoj7g1W0OE2e
TLSH
T1E9E46C55A7E801F9E177D2B8CE624902E7727C550774E6CF039089BA1F23AD1AB3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_934a74d78c539ce323979fb51ef3f793_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-11-01_934a74d78c539ce323979fb51ef3f793_cobalt-strike_icedid_njrat_satacom_stealc

.exe 683KB

2026-11-01_934a74d78c539ce323979fb51ef3f793_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 62639b13c16f50bbd42e6dfac2765fad
SHA256 951d99d318f1b48c3987e8f5fbd6dca4a6f2757db92fc91313776e9cc54c31f1
MD5 934a74d78c539ce323979fb51ef3f793
SHA1 751adec25ad7d8d5a57e15ce567b97fd0732ef40
SHA512 3ce030c35d6c9f1cee7afd22a4bba5f4556b7f0b461e02ce73da75974f9d579eb0fc2e47ca584ea352115ef0b91ae576ca509a09f8a7ae1706c22fd7b7c51805
SSDEEP 12288:h+QDyjwvRptet19etOwreVvoJR7Qyi1W0vWE2c+0t:B98GtteVvoj7g1W0OE2e
TLSH
T1E9E46C55A7E801F9E177D2B8CE624902E7727C550774E6CF039089BA1F23AD1AB3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

186752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges AllocateAndInitializeSid FreeSid LookupPrivilegeValueW SetEntriesInAclW SetNamedSecurityInfoW RegDeleteValueW RegGetValueW RegCreateKeyExW RegEnumValueW CheckTokenMembership

shell32

SHGetFolderPathW ShellExecuteExW

shlwapi

SHDeleteKeyW

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoUninitialize

oleaut32

VariantClear VariantInit SafeArrayGetVartype SafeArrayGetElement SafeArrayGetLBound SysAllocString SysFreeString SafeArrayGetUBound

dxgi

CreateDXGIFactory

iphlpapi

GetAdaptersAddresses

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiCallClassInstaller SetupDiGetClassDevsW SetupDiSetClassInstallParamsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

user32

GetMessageW TranslateMessage SetProcessDPIAware LoadCursorW SetWindowLongPtrW PtInRect FillRect ScreenToClient GetCursorPos MessageBoxW GetClientRect GetWindowTextW InvalidateRect EndPaint BeginPaint UpdateWindow DrawTextW KillTimer SetTimer SetFocus ShowWindow DestroyWindow CreateWindowExW RegisterClassW CallWindowProcW PostQuitMessage DefWindowProcW PostMessageW SendMessageW DispatchMessageW

gdi32

SetTextColor SetBkMode SelectObject DeleteObject DeleteDC CreateSolidBrush CreateFontW CreateCompatibleDC CreateCompatibleBitmap BitBlt

gdiplus

GdipDeletePath GdipClosePathFigure GdipAddPathArc GdipCreatePath GdiplusShutdown GdiplusStartup GdipDeleteBrush GdipCreateSolidFill GdipCreatePen1 GdipDeletePen GdipSetPenEndCap GdipCreateFromHDC GdipDeleteGraphics GdipFillPath GdipDrawLines GdipDrawLine GdipSetSmoothingMode GdipSetPenStartCap

dwmapi

DwmSetWindowAttribute

kernel32

GetACP IsValidCodePage ReadConsoleW GetOEMCP GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP HeapReAlloc SetFilePointerEx GetCommandLineA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetFileType HeapAlloc HeapFree UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle TerminateProcess ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW FlushFileBuffers RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive QueryPerformanceCounter LCMapStringEx DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetStringTypeW DecodePointer EncodePointer CloseHandle GetCurrentProcess LocalFree Sleep GetLastError WaitForSingleObject CreateProcessW GetSystemTimeAsFileTime SetComputerNameExW GetModuleHandleW GetProcAddress CreateFileW GetVolumeInformationW DeviceIoControl GetSystemFirmwareTable CreateDirectoryW DeleteFileW RemoveDirectoryW WriteFile GetTempPathW SetEvent CreateEventW SetWaitableTimer CreateWaitableTimerExW WaitForMultipleObjects GetCurrentProcessId GetExitCodeProcess GetLocalTime GetTickCount64 FreeLibrary GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar WideCharToMultiByte FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 AreFileApisANSI CopyFile2 GetFileInformationByHandleEx WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread RtlUnwind

Name

.text

Size

344KB

Virtual Size

343KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

201KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_934a74d78c539ce323979fb51ef3f793_cobalt-strike_icedid_njrat_satacom_stealc

advapi32

shell32

shlwapi

ole32

oleaut32

dxgi

iphlpapi

setupapi

user32

gdi32

gdiplus

dwmapi

kernel32

generic