2026-06-28_c6e014fa93880eacf7cf80553d57d635_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-28_c6e014fa93880eacf7cf80553d57d635_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.9MB
Sample260628-xwtmdacs2y
SHA256 edfe54fc031bc522856bffc9297c3246f2da70a50aef05a70af08b8eedfdf655
MD5 c6e014fa93880eacf7cf80553d57d635
SHA1 6a52508a08a6e9197de7550f7b789fd00fa6796f
SHA512 94b509398a312918b304412def6790d73843907502e18f7473999d3d82137063a86508c1c10ffaddd03f481220b93babef8270cf645196ab9df2c1b486cc3b54
SSDEEP 24576:WVrCu21zLO/oREuHkbcjiWcXjswCGqSUnKiY8SOWbZZZlj5AVXXwLBkfRJ:YCu2pVREMkbjswpunTY8SOUkmQ
TLSH
T19F95BE06F36681ECC227D5B8C6939707E7717824476486EF67C00A6ABFAB5D09F7A340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_c6e014fa93880eacf7cf80553d57d635_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-06-28_c6e014fa93880eacf7cf80553d57d635_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.9MB

2026-06-28_c6e014fa93880eacf7cf80553d57d635_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 9393b817d600d97978324aef89f8ec2a
SHA256 edfe54fc031bc522856bffc9297c3246f2da70a50aef05a70af08b8eedfdf655
MD5 c6e014fa93880eacf7cf80553d57d635
SHA1 6a52508a08a6e9197de7550f7b789fd00fa6796f
SHA512 94b509398a312918b304412def6790d73843907502e18f7473999d3d82137063a86508c1c10ffaddd03f481220b93babef8270cf645196ab9df2c1b486cc3b54
SSDEEP 24576:WVrCu21zLO/oREuHkbcjiWcXjswCGqSUnKiY8SOWbZZZlj5AVXXwLBkfRJ:YCu2pVREMkbjswpunTY8SOUkmQ
TLSH
T19F95BE06F36681ECC227D5B8C6939707E7717824476486EF67C00A6ABFAB5D09F7A340
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

725952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\linux\Desktop\Cs2_Skin\New_Skins\bin\XM-External.pdb

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

shell32

SHGetFolderPathA ShellExecuteA SHGetFolderPathW

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpQueryHeaders

winmm

timeBeginPeriod

d3dcompiler_47

D3DCompile

kernel32

GetExitCodeProcess HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale CreatePipe ReadConsoleW SetConsoleTextAttribute SetConsoleTitleA GetStdHandle WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle ExitProcess VerSetConditionMask GetConsoleWindow VerifyVersionInfoW QueryFullProcessImageNameW SetConsoleTitleW ReadProcessMemory Module32FirstW Module32NextW GetModuleFileNameW Sleep GetFileAttributesA GetModuleHandleW WideCharToMultiByte GetCurrentProcess GetLastError LocalFree CreateDirectoryA GetModuleFileNameA SizeofResource WriteProcessMemory LoadLibraryExA FindResourceA GetModuleHandleA MultiByteToWideChar GetExitCodeThread LoadLibraryA LockResource LoadResource GetProcAddress VirtualAllocEx CreateRemoteThread VirtualFreeEx CreateFileMappingW MapViewOfFile QueryUnbiasedInterruptTime GlobalAlloc GlobalFree GlobalLock GetLocaleInfoA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCommandLineW GetCommandLineA WriteFile TerminateProcess IsProcessorFeaturePresent ReadFile CreateProcessW DuplicateHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW GetCPInfo IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize CreateFileW WriteConsoleW SetEndOfFile GlobalUnlock GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetFileInformationByHandleEx FormatMessageA GetLocaleInfoEx GetSystemTimePreciseAsFileTime GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeConditionVariable WakeAllConditionVariable LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx

user32

ScreenToClient GetCapture TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetCursorPos DefWindowProcW DestroyWindow CreateWindowExW UnregisterClassW DispatchMessageW PeekMessageW SetLayeredWindowAttributes TranslateMessage LoadCursorW UpdateWindow GetWindowRect SetWindowPos MessageBoxW EnumDisplayMonitors GetKeyboardLayoutNameA GetSystemMetrics GetWindowLongPtrW ShowWindow IsWindow GetAsyncKeyState GetMonitorInfoW ClientToScreen SetWindowDisplayAffinity MessageBoxA FindWindowW GetClientRect GetMessageExtraInfo GetKeyState RegisterClassExW SetWindowLongPtrW

advapi32

ConvertSidToStringSidA GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW AdjustTokenPrivileges LookupPrivilegeValueW

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow

Name

.text

Size

921KB

Virtual Size

921KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

191KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

634KB

Virtual Size

642KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

180KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_c6e014fa93880eacf7cf80553d57d635_cobalt-strike_icedid_njrat_satacom_stealc

d3d11

dwmapi

shell32

winhttp

winmm

d3dcompiler_47

kernel32

user32

advapi32

imm32

generic