2026-11-01_8e7f126d8925a7752b5de8d4643a07fc_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_8e7f126d8925a7752b5de8d4643a07fc_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.4MB
Sample261102-shqlcac16j
SHA256 cbeea38d70296a2e0cd28e6e89f6b011d24aa04db53246c7082160c4e2310443
MD5 8e7f126d8925a7752b5de8d4643a07fc
SHA1 c9cbee468563b0a50c8d416402afe56d2a3bcc17
SHA512 8253ea9f141f814d1d89934c1a1fd68da9950ab18efcf8efa61b7969fb4bd0d93624849564c1e4f43e236f4c38ee81fc1e4ac6afc963ad8f423b0cb99b05f75f
SSDEEP 24576:Cr9nyhmx4nWMczZpoLq0n0kF2eGWetfQzrTvgnZ0R432crt4s/LMZGKM:Cr9nyRnWMspoLb85W9zonjhres/gPM
TLSH
T1A565CF56F26841E9D06BE03885BB8A06EBB5784553311ADF23586D5A2F376F06F3F320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_8e7f126d8925a7752b5de8d4643a07fc_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-11-01_8e7f126d8925a7752b5de8d4643a07fc_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.4MB

2026-11-01_8e7f126d8925a7752b5de8d4643a07fc_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH e0b9c45057b854bae3ea8a4006c4eb78
SHA256 cbeea38d70296a2e0cd28e6e89f6b011d24aa04db53246c7082160c4e2310443
MD5 8e7f126d8925a7752b5de8d4643a07fc
SHA1 c9cbee468563b0a50c8d416402afe56d2a3bcc17
SHA512 8253ea9f141f814d1d89934c1a1fd68da9950ab18efcf8efa61b7969fb4bd0d93624849564c1e4f43e236f4c38ee81fc1e4ac6afc963ad8f423b0cb99b05f75f
SSDEEP 24576:Cr9nyhmx4nWMczZpoLq0n0kF2eGWetfQzrTvgnZ0R432crt4s/LMZGKM:Cr9nyRnWMspoLb85W9zonjhres/gPM
TLSH
T1A565CF56F26841E9D06BE03885BB8A06EBB5784553311ADF23586D5A2F376F06F3F320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

739344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Module32FirstW Module32NextW SetConsoleTitleA OpenProcess Process32NextW Process32FirstW MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetFileAttributesA Sleep GetModuleHandleW SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetTimeZoneInformation HeapReAlloc GetOEMCP GetACP IsValidCodePage DeleteFileW CreateProcessW GetExitCodeProcess WaitForSingleObject ReadConsoleW EnumSystemLocalesW CloseHandle IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect HeapAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleFileNameW CreateToolhelp32Snapshot QueryFullProcessImageNameW WideCharToMultiByte LoadResource GetModuleHandleExW TerminateProcess ExitProcess GetCurrentProcess LockResource GetTickCount64 IsProcessorFeaturePresent ReadFile FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead FindResourceA WriteProcessMemory SizeofResource GetUserDefaultLCID ReadProcessMemory LocalFree FormatMessageA GetLocaleInfoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind

user32

GetForegroundWindow GetAsyncKeyState MapVirtualKeyW GetWindowThreadProcessId SetClipboardData SendInput EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos mouse_event GetClipboardData ReleaseCapture GetWindowLongW DefWindowProcW SetWindowPos CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow IsWindow DispatchMessageW PeekMessageW SetWindowDisplayAffinity SetLayeredWindowAttributes TranslateMessage SetWindowLongW PostQuitMessage FindWindowA UpdateWindow DestroyWindow UnregisterClassA GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode

shell32

SHGetFolderPathA

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winmm

timeBeginPeriod timeEndPeriod waveOutWrite waveOutUnprepareHeader waveOutClose waveOutReset waveOutOpen waveOutPrepareHeader

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

960KB

Virtual Size

959KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

209KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_8e7f126d8925a7752b5de8d4643a07fc_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

shell32

d3d11

d3dcompiler_47

dwmapi

winmm

imm32

generic