2026-11-14_b425d8abeecb7b9a6c1f8ef21e71b5a8_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-14_b425d8abeecb7b9a6c1f8ef21e71b5a8_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.6MB
Sample261114-ebq2msct5w
SHA256 3af26910e2e8b5dfbb258eb0880e45fa19f2d3d59093b486299709ded3407850
MD5 b425d8abeecb7b9a6c1f8ef21e71b5a8
SHA1 4c660134145cf201c4a053d183f07f485be1f249
SHA512 0f30563cd134a8ceb099f3343c8067cf8c1ab7e4ec460840ddeb004c2d163152f48db658ea9ad29185ccda231d72d0cf62e9e765ea3bfbee27c4042e6a3c2a31
SSDEEP 49152:bh1LienaBt6UAXsgOQ5s8S+tqwvW1RReKKAbZI2:bXL5naiHRpqwvcNI2
TLSH
T1AC751216E7A508FEE673C1B9C9528A01EB727C8A0324EBDF175019621F176D49F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-11-14_b425d8abeecb7b9a6c1f8ef21e71b5a8_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-11-14_b425d8abeecb7b9a6c1f8ef21e71b5a8_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.6MB

2026-11-14_b425d8abeecb7b9a6c1f8ef21e71b5a8_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 5e45e918296bd72909501c0c4ac1f750
SHA256 3af26910e2e8b5dfbb258eb0880e45fa19f2d3d59093b486299709ded3407850
MD5 b425d8abeecb7b9a6c1f8ef21e71b5a8
SHA1 4c660134145cf201c4a053d183f07f485be1f249
SHA512 0f30563cd134a8ceb099f3343c8067cf8c1ab7e4ec460840ddeb004c2d163152f48db658ea9ad29185ccda231d72d0cf62e9e765ea3bfbee27c4042e6a3c2a31
SSDEEP 49152:bh1LienaBt6UAXsgOQ5s8S+tqwvW1RReKKAbZI2:bXL5naiHRpqwvcNI2
TLSH
T1AC751216E7A508FEE673C1B9C9528A01EB727C8A0324EBDF175019621F176D49F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

fe:f1:c6:b1:eb:d8:49:ff:f0:3a:d3:dd:d4:14:e8:b8:7c:4e:6a:90:8d:d4:26:d1:14:04:01:ea:57:a6:97:ed

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=WCR Test Signing

Chains

Nov 13, 2026

CN=WCR Test Signing

Minor OS version

Major OS version

Entry point

95872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptGetProperty BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptGenRandom BCryptDestroyKey BCryptDecrypt

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

SafeArrayAccessData VariantChangeType VariantClear VariantInit SafeArrayCreateVector SafeArrayUnaccessData SysFreeString

advapi32

OpenProcessToken RegSetValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey GetTokenInformation

kernel32

SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage GetStringTypeW FindFirstFileExW FindClose GetConsoleMode GetConsoleOutputCP GetFileType GetProcessHeap HeapSize HeapReAlloc WriteConsoleW FindNextFileW GetCurrentThreadId GetCommandLineW CreateFileW DeleteFileW FlushFileBuffers GetFileSizeEx ReadFile SetFilePointerEx GetTempPathW CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcessId GetExitCodeProcess CreateProcessW GetModuleFileNameW GetCurrentProcess VirtualAlloc VirtualProtect VirtualFree VirtualQuery GetModuleHandleW GetProcAddress LoadLibraryExW LoadLibraryW MultiByteToWideChar FlushInstructionCache WideCharToMultiByte GetEnvironmentVariableW GetFileAttributesW GetSystemDirectoryW CopyFileW WriteFile QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree CompareStringW LCMapStringW

Name

.text

Size

181KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-14_b425d8abeecb7b9a6c1f8ef21e71b5a8_cobalt-strike_icedid_njrat_satacom_stealc

PE Signature issue

bcrypt

ole32

oleaut32

advapi32

kernel32

generic