2026-11-01_87e80122314822b67a7a111e892edce2_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-11-01_87e80122314822b67a7a111e892edce2_cobalt-strike_icedid_njrat_satacom_stealc
Size 623KB
Sample261102-s8dpgabs5t
SHA256 f5bf386266cbfdafd3a3c0ca133ec9c6559fbf23b2cc39304fd23130b2c951f6
MD5 87e80122314822b67a7a111e892edce2
SHA1 7850d282e3e86abb8e9ee046ca6c28db8e0f6b49
SHA512 a2b16c347d3434f66a39cb1af28a3be7e24e13a3decbb480abb486868a373b4d9dce78fee467c8d6d1ac4e7fa045b03b9b8a4653f05cf457649f13bc6bde573f
SSDEEP 12288:L0HCsX9qB5avihoDFx9qMG3Ys1vtFJm+:GtUraKhoJx9lGos116+
TLSH
T11CD47D56EBA403F8D17BC1B4CA828956EB76F815433456CB03E24A635F376A05B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_87e80122314822b67a7a111e892edce2_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-11-01_87e80122314822b67a7a111e892edce2_cobalt-strike_icedid_njrat_satacom_stealc

.exe 623KB

2026-11-01_87e80122314822b67a7a111e892edce2_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH a1fa2d08960884e06f2dc59bd5f7a43c
SHA256 f5bf386266cbfdafd3a3c0ca133ec9c6559fbf23b2cc39304fd23130b2c951f6
MD5 87e80122314822b67a7a111e892edce2
SHA1 7850d282e3e86abb8e9ee046ca6c28db8e0f6b49
SHA512 a2b16c347d3434f66a39cb1af28a3be7e24e13a3decbb480abb486868a373b4d9dce78fee467c8d6d1ac4e7fa045b03b9b8a4653f05cf457649f13bc6bde573f
SSDEEP 12288:L0HCsX9qB5avihoDFx9qMG3Ys1vtFJm+:GtUraKhoJx9lGos116+
TLSH
T11CD47D56EBA403F8D17BC1B4CA828956EB76F815433456CB03E24A635F376A05B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

286224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

MultiByteToWideChar LoadLibraryA GetProcAddress GetCurrentProcess SetEndOfFile QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId WideCharToMultiByte GetStringTypeW GetLocaleInfoEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode CloseHandle VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize WriteConsoleW RtlUnwind

Name

.text

Size

451KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

46KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_87e80122314822b67a7a111e892edce2_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

generic