2026-11-11_4dc2a7c8a4411b9ad53c262446c82a1d_cobalt-strike_icedid_quasar-rat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-11_4dc2a7c8a4411b9ad53c262446c82a1d_cobalt-strike_icedid_quasar-rat_satacom
Size 13.6MB
Sample261113-pyfvasvz2l
SHA256 e4da9f1ffab3ba5231ed1367008e972cd911ea9423d3e9cf9439799b179535e1
MD5 4dc2a7c8a4411b9ad53c262446c82a1d
SHA1 42fa633d3fcbc2b9049c33e0b01bd88af6a76d67
SHA512 705af8e542e861986d8ee99ee79bbb0e14ffbcf3b98ace76cbc5e1ff0ba67b95ed78d4da2cce12bce15c6d704e842bffce8418120b5438f7eac78c9ea1063db9
SSDEEP 196608:5prpnCgcbPmunFOl56R7DiKVt/PnOntm7g:57C7buuFOD6RHiYt/Pnyt2g
TLSH
T1F5E6C002B66F95ACD057C47093065627AE31748B0B2AF9FF52C645383FAA7E01F39786
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_4dc2a7c8a4411b9ad53c262446c82a1d_cobalt-strike_icedid_quasar-rat_satacom

File Explorer

2026-11-11_4dc2a7c8a4411b9ad53c262446c82a1d_cobalt-strike_icedid_quasar-rat_satacom

.exe 13.6MB

2026-11-11_4dc2a7c8a4411b9ad53c262446c82a1d_cobalt-strike_icedid_quasar-rat_satacom

IMPHASH 9755109224ff4b099963322e366a6619
SHA256 e4da9f1ffab3ba5231ed1367008e972cd911ea9423d3e9cf9439799b179535e1
MD5 4dc2a7c8a4411b9ad53c262446c82a1d
SHA1 42fa633d3fcbc2b9049c33e0b01bd88af6a76d67
SHA512 705af8e542e861986d8ee99ee79bbb0e14ffbcf3b98ace76cbc5e1ff0ba67b95ed78d4da2cce12bce15c6d704e842bffce8418120b5438f7eac78c9ea1063db9
SSDEEP 196608:5prpnCgcbPmunFOl56R7DiKVt/PnOntm7g:57C7buuFOD6RHiYt/Pnyt2g
TLSH
T1F5E6C002B66F95ACD057C47093065627AE31748B0B2AF9FF52C645383FAA7E01F39786
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6409984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

volbind.pdb

bcryptprimitives

ProcessPrng

kernel32

ExitThread GlobalSize WideCharToMultiByte InitializeCriticalSectionEx EncodePointer IsProcessorFeaturePresent lstrlenW FlsGetValue CloseHandle RtlPcToFileHeader RtlUnwindEx GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetStringTypeW GetFileType GetCPInfo GetOEMCP CompareStringOrdinal GetACP SetLastError GetFullPathNameW DuplicateHandle FlushFileBuffers SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx SetFilePointerEx FindFirstFileExW FindClose GetFinalPathNameByHandleW DeleteFileW HeapAlloc GetFileAttributesW FindNextFileW SetFileAttributesW MoveFileExW IsValidCodePage LCMapStringW CompareStringW IsDebuggerPresent UnhandledExceptionFilter VirtualProtect GetTimeZoneInformation MapViewOfFile GetFileSize LocalFree UnlockFile HeapDestroy HeapCompact DeleteFileA FlushViewOfFile SetEnvironmentVariableW GlobalUnlock GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile GetTempPathW SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI GlobalFree HeapReAlloc MultiByteToWideChar DeleteCriticalSection HeapFree TryEnterCriticalSection LeaveCriticalSection Sleep GetModuleHandleA GetProcessHeap SetStdHandle EnterCriticalSection InitializeCriticalSection RaiseException ReadFile WriteFile OutputDebugStringA UnlockFileEx CreateMutexW OutputDebugStringW CreateFileA GetSystemInfo LockFileEx SystemTimeToFileTime GetSystemTimeAsFileTime GetCurrentThread GetModuleHandleExW GetModuleFileNameW GetSystemTime SwitchToThread FormatMessageA CreateFileMappingW GetTickCount LoadLibraryExW GetCurrentThreadId SetThreadErrorMode FreeLibraryAndExitThread GlobalAlloc TerminateProcess LoadLibraryExA QueryPerformanceFrequency FlsSetValue IsThreadAFiber GetModuleHandleW FlsAlloc FlsFree SetWaitableTimer CreateWaitableTimerExW FreeLibrary GetConsoleOutputCP GetConsoleMode WriteConsoleW GetEnvironmentVariableW ReleaseMutex GetCommandLineA GetFileAttributesA GlobalLock CreateMutexA LoadLibraryA WaitForSingleObjectEx ExitProcess GetCurrentProcessId GetCommandLineW GetCurrentDirectoryW FormatMessageW GetProcAddress SetThreadStackGuarantee AddVectoredExceptionHandler LoadLibraryW CreateDirectoryW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetLastError GetFileAttributesExW FreeEnvironmentStringsW GetEnvironmentStringsW SleepEx ReadFileEx WriteFileEx CreateFileW WaitForSingleObject GetStdHandle GetCurrentProcess QueryPerformanceCounter CreateThread RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime

shlwapi

AssocQueryStringW

oleaut32

SysStringLen SysAllocStringLen SysFreeString VariantClear SafeArrayCreateVector GetErrorInfo SetErrorInfo SafeArrayPutElement

user32

GetSystemMenu EnableMenuItem SetWindowLongW GetWindowLongW AdjustWindowRectEx ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetKeyboardState CreateIcon DestroyIcon GetClipCursor ClipCursor ShowCursor SetWindowDisplayAffinity RegisterWindowMessageA DestroyCursor GetKeyState GetActiveWindow RegisterTouchWindow GetAsyncKeyState IsProcessDPIAware LoadCursorW ShowWindow GetRawInputData SetCursor SetWindowPos PostMessageW DestroyWindow DispatchMessageW RemovePropW GetWindowTextLengthW GetSystemMetrics GetWindowLongPtrW SendMessageW CallWindowProcW GetPropW TranslateMessage SystemParametersInfoA CloseTouchInputHandle SetWindowLongPtrW SetPropW GetWindowPlacement SetWindowPlacement FlashWindowEx GetWindowRect GetTouchInputInfo MsgWaitForMultipleObjectsEx TrackMouseEvent SetCapture GetClientRect ValidateRect GetMenu SetWindowTextW GetForegroundWindow MapVirtualKeyW ReleaseCapture GetCursorPos MonitorFromRect ScreenToClient SendInput SetForegroundWindow IsIconic RegisterRawInputDevices GetClassNameW GetClassInfoExW RegisterClassExW PeekMessageW GetDC MonitorFromWindow CreateWindowExW ChangeDisplaySettingsExW InvalidateRgn EnumDisplayMonitors RedrawWindow MonitorFromPoint GetMonitorInfoW ReleaseDC GetWindowTextW RegisterClipboardFormatW GetClipboardData IsClipboardFormatAvailable OpenClipboard CloseClipboard SetClipboardData EmptyClipboard CreateIconFromResourceEx ClientToScreen MessageBoxW DefWindowProcW SetCursorPos

gdi32

DescribePixelFormat ChoosePixelFormat SetPixelFormat GetDeviceCaps CreateRectRgn SwapBuffers DeleteObject

shell32

DragQueryFileW DragFinish SHCreateItemFromParsingName SHGetKnownFolderPath

combase

CoTaskMemFree

ole32

CoInitializeEx CoUninitialize RevokeDragDrop RegisterDragDrop CoCreateInstance OleInitialize

ntdll

NtReadFile NtWriteFile NtCreateNamedPipeFile NtOpenFile RtlNtStatusToDosError

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

uiautomationcore

UiaLookupId UiaRaiseAutomationPropertyChangedEvent UiaReturnRawElementProvider UiaHostProviderFromHwnd UiaGetReservedNotSupportedValue UiaRaiseAutomationEvent

advapi32

RevertToSelf ImpersonateAnonymousToken

opengl32

wglShareLists wglCreateContext wglGetCurrentDC wglGetCurrentContext wglGetProcAddress wglDeleteContext wglMakeCurrent

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmGetCompositionStringW ImmAssociateContextEx ImmReleaseContext ImmGetContext

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

uxtheme

SetWindowTheme

Name

.text

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.1MB

Virtual Size

7.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

195KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_4dc2a7c8a4411b9ad53c262446c82a1d_cobalt-strike_icedid_quasar-rat_satacom

bcryptprimitives

kernel32

shlwapi

oleaut32

user32

gdi32

shell32

combase

ole32

ntdll

api-ms-win-core-synch-l1-2-0

uiautomationcore

advapi32

opengl32

imm32

dwmapi

uxtheme

generic