2026-11-14_f031a0bed5ef37c1463959dede553288_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-14_f031a0bed5ef37c1463959dede553288_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.6MB
Sample261114-dpqscsvs2p
SHA256 0cd387bf021a4c905175938a29ca44ebdf743e4233518d6d8a93cb1201ccd6d3
MD5 f031a0bed5ef37c1463959dede553288
SHA1 703746a800c2ce4d23536bd54ebc1b4725a723d4
SHA512 8c469d10d5789c14abba8ee2141ceb6bf06a314576a6c20e317edcde344a726984160a0bff015606d5f5ed66919b59c446789ec772080e294d1f05ff9f4ed410
SSDEEP 49152:ah1ZDR1M0IIrB1sctWlc53knmOhSFpvflQ:aX9Re0jQcn538mFJO
TLSH
T11775121AE6640CFDE567D5BCCE228A02E6723C4A4360EADF135059631F176D49F3BB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-11-14_f031a0bed5ef37c1463959dede553288_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-11-14_f031a0bed5ef37c1463959dede553288_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.6MB

2026-11-14_f031a0bed5ef37c1463959dede553288_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 5e45e918296bd72909501c0c4ac1f750
SHA256 0cd387bf021a4c905175938a29ca44ebdf743e4233518d6d8a93cb1201ccd6d3
MD5 f031a0bed5ef37c1463959dede553288
SHA1 703746a800c2ce4d23536bd54ebc1b4725a723d4
SHA512 8c469d10d5789c14abba8ee2141ceb6bf06a314576a6c20e317edcde344a726984160a0bff015606d5f5ed66919b59c446789ec772080e294d1f05ff9f4ed410
SSDEEP 49152:ah1ZDR1M0IIrB1sctWlc53knmOhSFpvflQ:aX9Re0jQcn538mFJO
TLSH
T11775121AE6640CFDE567D5BCCE228A02E6723C4A4360EADF135059631F176D49F3BB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b0:71:3b:c7:4c:ef:8e:4b:cb:da:4a:5b:79:31:75:f3:c5:e2:96:47:d8:a5:e2:5e:37:13:bd:a2:be:51:bd:e1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=WCR Test Signing

Chains

Nov 13, 2026

CN=WCR Test Signing

Minor OS version

Major OS version

Entry point

95872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptGetProperty BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptGenRandom BCryptDestroyKey BCryptDecrypt

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

SafeArrayAccessData VariantChangeType VariantClear VariantInit SafeArrayCreateVector SafeArrayUnaccessData SysFreeString

advapi32

OpenProcessToken RegSetValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey GetTokenInformation

kernel32

SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage GetStringTypeW FindFirstFileExW FindClose GetConsoleMode GetConsoleOutputCP GetFileType GetProcessHeap HeapSize HeapReAlloc WriteConsoleW FindNextFileW GetCurrentThreadId GetCommandLineW CreateFileW DeleteFileW FlushFileBuffers GetFileSizeEx ReadFile SetFilePointerEx GetTempPathW CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcessId GetExitCodeProcess CreateProcessW GetModuleFileNameW GetCurrentProcess VirtualAlloc VirtualProtect VirtualFree VirtualQuery GetModuleHandleW GetProcAddress LoadLibraryExW LoadLibraryW MultiByteToWideChar FlushInstructionCache WideCharToMultiByte GetEnvironmentVariableW GetFileAttributesW GetSystemDirectoryW CopyFileW WriteFile QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree CompareStringW LCMapStringW

Name

.text

Size

181KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-14_f031a0bed5ef37c1463959dede553288_cobalt-strike_icedid_njrat_satacom_stealc

PE Signature issue

bcrypt

ole32

oleaut32

advapi32

kernel32

generic