2026-11-03_7cbc34e087828fb1720939472fe35bb0_cobalt-strike_icedid_njrat_satacom

General

Target
2026-11-03_7cbc34e087828fb1720939472fe35bb0_cobalt-strike_icedid_njrat_satacom
Size 145KB
Sample261104-th8btssyev
SHA256 7681589b4a91a64bd7c0ca44bcfde3ac5045bb226657674336a680470c180b7e
MD5 7cbc34e087828fb1720939472fe35bb0
SHA1 8b23001b671ffc62c3a55055ee70ae8dff9bdb39
SHA512 8563782e7a631f0acdba61c70c7eb23fc707b15bd1368422923a6c144a86750830fb901ff989426d6ac66724e24d1b046476c4dac27e3d4698734a56083bfe08
SSDEEP 3072:x0ZU9kpi8kFJnq+Dre3l/+2Mqb1t8ArSgX+Sp6Q:NB8Unqgy+7qbLNSr
TLSH
T1C6E35C57B3E530F9E1778238C9614A46EB72783607609BEF03A447762F236D09D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_7cbc34e087828fb1720939472fe35bb0_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-11-03_7cbc34e087828fb1720939472fe35bb0_cobalt-strike_icedid_njrat_satacom

.exe 145KB

2026-11-03_7cbc34e087828fb1720939472fe35bb0_cobalt-strike_icedid_njrat_satacom

IMPHASH ae2760f3713241b56cd599511576528b
SHA256 7681589b4a91a64bd7c0ca44bcfde3ac5045bb226657674336a680470c180b7e
MD5 7cbc34e087828fb1720939472fe35bb0
SHA1 8b23001b671ffc62c3a55055ee70ae8dff9bdb39
SHA512 8563782e7a631f0acdba61c70c7eb23fc707b15bd1368422923a6c144a86750830fb901ff989426d6ac66724e24d1b046476c4dac27e3d4698734a56083bfe08
SSDEEP 3072:x0ZU9kpi8kFJnq+Dre3l/+2Mqb1t8ArSgX+Sp6Q:NB8Unqgy+7qbLNSr
TLSH
T1C6E35C57B3E530F9E1778238C9614A46EB72783607609BEF03A447762F236D09D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle GetLastError MapViewOfFile UnmapViewOfFile OpenFileMappingA QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW WriteConsoleW RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc CreateFileW

Name

.text

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_7cbc34e087828fb1720939472fe35bb0_cobalt-strike_icedid_njrat_satacom

kernel32

generic