2026-11-12_484daeb4c5da0d2ff22f44b584318c83_cobalt-strike_icedid_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_484daeb4c5da0d2ff22f44b584318c83_cobalt-strike_icedid_njrat_satacom
Size 1.5MB
Sample261113-ejkjtsfy8m
SHA256 f6d7bde4003a62d240ed7856b10bfeab9fa94fbb56026cc4a844c259a87bf577
MD5 484daeb4c5da0d2ff22f44b584318c83
SHA1 ea557fc69ae619109f2fc1ac251aebbbdfe9a0c4
SHA512 9febb87a7b6150741fd1cd8fdf6703600fefcf9a77b24be0e932a425ad6355d2509c75f820a2d1358e33e1605912a7f34f610b38d3bf2d21106a2dd985b584a9
SSDEEP 24576:1Fl6smFzfMtYFVOLuDxFK+x3UyPHJ0swd/Z2mm61y1nFffex2JHLgJIe0QmM:1FlRmppVOLutbxkQHJY/Z5m64uKrgq
TLSH
T10175011AA7A410FCE1A7D1B4CD574502EB72FC4A4B31E5DF03E45A960F236E09A3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_484daeb4c5da0d2ff22f44b584318c83_cobalt-strike_icedid_njrat_satacom

File Explorer

2026-11-12_484daeb4c5da0d2ff22f44b584318c83_cobalt-strike_icedid_njrat_satacom

.exe 1.5MB

2026-11-12_484daeb4c5da0d2ff22f44b584318c83_cobalt-strike_icedid_njrat_satacom

IMPHASH 3768f21e6d55112a260695943399fd6d
SHA256 f6d7bde4003a62d240ed7856b10bfeab9fa94fbb56026cc4a844c259a87bf577
MD5 484daeb4c5da0d2ff22f44b584318c83
SHA1 ea557fc69ae619109f2fc1ac251aebbbdfe9a0c4
SHA512 9febb87a7b6150741fd1cd8fdf6703600fefcf9a77b24be0e932a425ad6355d2509c75f820a2d1358e33e1605912a7f34f610b38d3bf2d21106a2dd985b584a9
SSDEEP 24576:1Fl6smFzfMtYFVOLuDxFK+x3UyPHJ0swd/Z2mm61y1nFffex2JHLgJIe0QmM:1FlRmppVOLutbxkQHJY/Z5m64uKrgq
TLSH
T10175011AA7A410FCE1A7D1B4CD574502EB72FC4A4B31E5DF03E45A960F236E09A3E722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1406656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

advapi32

RegOpenKeyExW RegEnumKeyExW RegCloseKey RegQueryValueExW GetUserNameW

ole32

CoUninitialize CoInitializeEx

iphlpapi

GetAdaptersAddresses

ws2_32

inet_ntop

kernel32

HeapSize WriteConsoleW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW HeapReAlloc SetEndOfFile LocalFree GetOEMCP GetACP GetLogicalDrives GetConsoleScreenBufferInfo SetConsoleTextAttribute GetStdHandle WaitForSingleObject Sleep GetLastError GetDiskFreeSpaceExW CloseHandle GetSystemInfo GetLocalTime GetComputerNameW GlobalMemoryStatusEx CreateProcessW WideCharToMultiByte SetConsoleOutputCP GetDriveTypeW GetExitCodeProcess ExpandEnvironmentStringsW GetEnvironmentVariableW ReadFile SetFilePointer CreateFileW WriteFile CreateNamedPipeW PeekNamedPipe GetCurrentThreadId GetCurrentProcessId GetTickCount ConnectNamedPipe GetModuleHandleW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFinalPathNameByHandleW SetFileInformationByHandle GetTempPathW CreateFile2 AreFileApisANSI GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar RtlUnwind FormatMessageA GetLocaleInfoEx GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW IsValidCodePage RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree FlushFileBuffers GetConsoleOutputCP GetConsoleMode VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW GetTimeZoneInformation

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

796B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_484daeb4c5da0d2ff22f44b584318c83_cobalt-strike_icedid_njrat_satacom

version

advapi32

ole32

iphlpapi

ws2_32

kernel32

generic