2026-11-14_3e18eb416abb3deaf7a2ce2ed03384b4_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-14_3e18eb416abb3deaf7a2ce2ed03384b4_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.6MB
Sample261114-e9lvkscw9y
SHA256 fe184315b0f209047df2a451c2035ffa3d407935547c1d5e3f5a1d455eabbfda
MD5 3e18eb416abb3deaf7a2ce2ed03384b4
SHA1 06f68fff39798d60a50bd8c23f7bbfd3a9c10093
SHA512 5b8371960370f4c49572db025fe91f0c72f5aedfb1ecbd3c05475bf87b794b15d4fc2277d08e43d02ab4ae3efd5c5d3deb5b3ab3deefb5b8c59d7d247f8a9ac7
SSDEEP 49152:ah1ZDR1M0IIrB1sctWlc53knmOhSFpvflu:aX9Re0jQcn538mFJ0
TLSH
T10575121AE6640CFDE567D5BCCE228A02E6723C4A4360EADF135059631F176D49F3BB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-14_3e18eb416abb3deaf7a2ce2ed03384b4_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-11-14_3e18eb416abb3deaf7a2ce2ed03384b4_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.6MB

2026-11-14_3e18eb416abb3deaf7a2ce2ed03384b4_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 5e45e918296bd72909501c0c4ac1f750
SHA256 fe184315b0f209047df2a451c2035ffa3d407935547c1d5e3f5a1d455eabbfda
MD5 3e18eb416abb3deaf7a2ce2ed03384b4
SHA1 06f68fff39798d60a50bd8c23f7bbfd3a9c10093
SHA512 5b8371960370f4c49572db025fe91f0c72f5aedfb1ecbd3c05475bf87b794b15d4fc2277d08e43d02ab4ae3efd5c5d3deb5b3ab3deefb5b8c59d7d247f8a9ac7
SSDEEP 49152:ah1ZDR1M0IIrB1sctWlc53knmOhSFpvflu:aX9Re0jQcn538mFJ0
TLSH
T10575121AE6640CFDE567D5BCCE228A02E6723C4A4360EADF135059631F176D49F3BB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

95872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptGetProperty BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptGenRandom BCryptDestroyKey BCryptDecrypt

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

SafeArrayAccessData VariantChangeType VariantClear VariantInit SafeArrayCreateVector SafeArrayUnaccessData SysFreeString

advapi32

OpenProcessToken RegSetValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey GetTokenInformation

kernel32

SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage GetStringTypeW FindFirstFileExW FindClose GetConsoleMode GetConsoleOutputCP GetFileType GetProcessHeap HeapSize HeapReAlloc WriteConsoleW FindNextFileW GetCurrentThreadId GetCommandLineW CreateFileW DeleteFileW FlushFileBuffers GetFileSizeEx ReadFile SetFilePointerEx GetTempPathW CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcessId GetExitCodeProcess CreateProcessW GetModuleFileNameW GetCurrentProcess VirtualAlloc VirtualProtect VirtualFree VirtualQuery GetModuleHandleW GetProcAddress LoadLibraryExW LoadLibraryW MultiByteToWideChar FlushInstructionCache WideCharToMultiByte GetEnvironmentVariableW GetFileAttributesW GetSystemDirectoryW CopyFileW WriteFile QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree CompareStringW LCMapStringW

Name

.text

Size

181KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-14_3e18eb416abb3deaf7a2ce2ed03384b4_cobalt-strike_icedid_njrat_satacom_stealc

bcrypt

ole32

oleaut32

advapi32

kernel32

generic