2026-11-03_6f543e22762b06d1d84f1d77eebd6354_cobalt-strike_icedid_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_6f543e22762b06d1d84f1d77eebd6354_cobalt-strike_icedid_satacom
Size 1.4MB
Sample261104-v3pkwstsdw
SHA256 84eabdf5c76b4bf66b8ae226fb80ddc1b9f74a76e08682f5207ddcdc461f1b07
MD5 6f543e22762b06d1d84f1d77eebd6354
SHA1 aa63f3c45090da674d42c105afc082604b1cee22
SHA512 ef065106b0c4048021ae2181509f7628352cff2f6a77c10148bba321417f8f0e7782fe461c63cc660957a7dae7403521719c0ce7a5698f176a6fa5dd47b0a78d
SSDEEP 24576:LZyNKayFfixZEiEXw6c7lkeLffY676mwAKiBYG:LZaKaY3HXNcBkafP74W
TLSH
T177652916B75525D8C17FC038D2478B62BA3130CA0B396AFB458582393F29EF96E3D764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_6f543e22762b06d1d84f1d77eebd6354_cobalt-strike_icedid_satacom

File Explorer

2026-11-03_6f543e22762b06d1d84f1d77eebd6354_cobalt-strike_icedid_satacom

.exe 1.4MB

2026-11-03_6f543e22762b06d1d84f1d77eebd6354_cobalt-strike_icedid_satacom

IMPHASH 55fa72774b2ddbbe8f0973c644dbb981
SHA256 84eabdf5c76b4bf66b8ae226fb80ddc1b9f74a76e08682f5207ddcdc461f1b07
MD5 6f543e22762b06d1d84f1d77eebd6354
SHA1 aa63f3c45090da674d42c105afc082604b1cee22
SHA512 ef065106b0c4048021ae2181509f7628352cff2f6a77c10148bba321417f8f0e7782fe461c63cc660957a7dae7403521719c0ce7a5698f176a6fa5dd47b0a78d
SSDEEP 24576:LZyNKayFfixZEiEXw6c7lkeLffY676mwAKiBYG:LZaKaY3HXNcBkafP74W
TLSH
T177652916B75525D8C17FC038D2478B62BA3130CA0B396AFB458582393F29EF96E3D764
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

942880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d9_shader_sources-cfc0cd09c3de59a3.pdb

kernel32

FormatMessageW HeapAlloc HeapFree GetProcessHeap GetModuleHandleA GetProcAddress FreeLibrary GetLastError EncodePointer CloseHandle GetFileAttributesW HeapSize LCMapStringW CompareStringW LoadLibraryExW GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA WriteFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection FlsGetValue LoadLibraryA GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo GetModuleHandleExW GetModuleFileNameW RtlLookupFunctionEntry VirtualProtect GetCurrentProcess GetCurrentThreadId RtlCaptureContext RtlRestoreContext QueryPerformanceCounter CreateThread GetModuleHandleW OutputDebugStringA CompareStringOrdinal FreeEnvironmentStringsW WaitForSingleObject SetLastError GetFullPathNameW SetFileInformationByHandle CreateFileW DuplicateHandle HeapReAlloc CreateEventW GetCurrentProcessId ReadFileEx SleepEx WriteFileEx ReadFile GetOverlappedResult FlushFileBuffers RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW TerminateProcess GetEnvironmentStringsW GetExitCodeProcess SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess GetSystemInfo SwitchToThread WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex GetEnvironmentVariableW SetEnvironmentVariableW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP FlsFree FlsAlloc IsThreadAFiber FlsSetValue GetFileType WaitForMultipleObjects QueryPerformanceFrequency SetStdHandle FindNextFileW RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtReadFile NtWriteFile NtOpenFile NtCreateNamedPipeFile

userenv

GetUserProfileDirectoryW

Name

.text

Size

989KB

Virtual Size

988KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

397KB

Virtual Size

396KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_6f543e22762b06d1d84f1d77eebd6354_cobalt-strike_icedid_satacom

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

ntdll

userenv

generic