2026-11-03_432bb2e04496dbca9c67408ae9f5c99a_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_432bb2e04496dbca9c67408ae9f5c99a_cobalt-strike_icedid_njrat_satacom_stealc
Size 348KB
Sample261104-2dpypaf18p
SHA256 c32c4cd2fb954b4cae66dcc7305519fc2af2ed04fc9b75cf8248ffa609330fef
MD5 432bb2e04496dbca9c67408ae9f5c99a
SHA1 52cf96a9d768297c43e8c1434057e7d62b7827c8
SHA512 a6713c742678c8f62f259a2800e11165ee7c89e50b169cf91eb40f54655eac550b0e6e7a5fc5a12b2491a1b209fbafcaf2d45ea0cd525012e9cbdf1d00256eef
SSDEEP 6144:Js+PiNYu3bz3KfTRWzoJ/706JRN/53qhcAs4QgQq1iBDMOjP5sBwjhi:JZAEWENn/tqhrQgQqywOL5
TLSH
T12A748E16F6A814F9E167D1BCC9534905EB737C5A0731AACF23A04A972F236D09E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_432bb2e04496dbca9c67408ae9f5c99a_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-11-03_432bb2e04496dbca9c67408ae9f5c99a_cobalt-strike_icedid_njrat_satacom_stealc

.exe 348KB

2026-11-03_432bb2e04496dbca9c67408ae9f5c99a_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 6af3a294f0d77b10ef8395b5b23ad695
SHA256 c32c4cd2fb954b4cae66dcc7305519fc2af2ed04fc9b75cf8248ffa609330fef
MD5 432bb2e04496dbca9c67408ae9f5c99a
SHA1 52cf96a9d768297c43e8c1434057e7d62b7827c8
SHA512 a6713c742678c8f62f259a2800e11165ee7c89e50b169cf91eb40f54655eac550b0e6e7a5fc5a12b2491a1b209fbafcaf2d45ea0cd525012e9cbdf1d00256eef
SSDEEP 6144:Js+PiNYu3bz3KfTRWzoJ/706JRN/53qhcAs4QgQq1iBDMOjP5sBwjhi:JZAEWENn/tqhrQgQqywOL5
TLSH
T12A748E16F6A814F9E167D1BCC9534905EB737C5A0731AACF23A04A972F236D09E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

100112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptSetProperty BCryptGenRandom BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

winhttp

WinHttpOpen WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle

shell32

SHGetFolderPathW

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA

kernel32

CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW HeapSize HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx WriteConsoleW SetEndOfFile GetCPInfo DeleteFileW GetDriveTypeW GetTempPathW CloseHandle WaitForSingleObject CreateProcessW GetComputerNameW MultiByteToWideChar WideCharToMultiByte LocalFree FormatMessageA GetLocaleInfoEx GetStringTypeW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx RtlUnwind SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead ReadFile RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Name

.text

Size

235KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_432bb2e04496dbca9c67408ae9f5c99a_cobalt-strike_icedid_njrat_satacom_stealc

bcrypt

winhttp

shell32

advapi32

kernel32

generic