2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.1MB
Sample260703-e5d9yabv4s
SHA256 debf8d12b485bb8872dd40ad424e0f23ca254c56f5aa335d9a20bf618f9c8969
MD5 0c273b22168a2610fc95af914b33c8cd
SHA1 cacf9c538b34779431ea54764d89f96489feed79
SHA512 cd197cc20a2078226876cde0ea5fb091cc1f1c933d50bf5626fd51c39319d8b02032fdffc66364a58abac6739eb82bdd4b105013c7c0b67f7f49121dd1f418c2
SSDEEP 12288:4DtRRdC4rGDHNEkkvaXs3HOD/5y2V7/WmGdctZpFiDjeats8MwWPAcI45s/Mu:XHNTkCXm2VqmGdcjp7d8MwWvI45m
TLSH
T104451901A6E402A8E1B7D774DE7B5845E777B94A0730E9DF0294955F0F339888A3EB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.1MB

2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 36d72b773f9ed5dd603770e3c8dcf5f0
SHA256 debf8d12b485bb8872dd40ad424e0f23ca254c56f5aa335d9a20bf618f9c8969
MD5 0c273b22168a2610fc95af914b33c8cd
SHA1 cacf9c538b34779431ea54764d89f96489feed79
SHA512 cd197cc20a2078226876cde0ea5fb091cc1f1c933d50bf5626fd51c39319d8b02032fdffc66364a58abac6739eb82bdd4b105013c7c0b67f7f49121dd1f418c2
SSDEEP 12288:4DtRRdC4rGDHNEkkvaXs3HOD/5y2V7/WmGdctZpFiDjeats8MwWPAcI45s/Mu:XHNTkCXm2VqmGdcjp7d8MwWvI45m
TLSH
T104451901A6E402A8E1B7D774DE7B5845E777B94A0730E9DF0294955F0F339888A3EB32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

653872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

IsWindowVisible IsIconic IsZoomed OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetKeyState SetCapture ReleaseCapture SetTimer KillTimer EnableWindow IsWindowEnabled CreatePopupMenu DestroyMenu AppendMenuW TrackPopupMenu DrawTextW UpdateWindow GetDC ReleaseDC SetWindowPos EndPaint InvalidateRect RedrawWindow ShowScrollBar SetWindowTextW GetWindowTextW GetWindowTextLengthW GetClientRect GetWindowRect MessageBoxW SetCursor GetCursorPos ClientToScreen ScreenToClient MapWindowPoints FillRect SetRectEmpty InflateRect GetWindowLongPtrW SetWindowLongPtrW GetParent LoadCursorW LoadIconW MoveWindow ShowWindow CreateWindowExW RegisterClassExW CallWindowProcW PostQuitMessage DefWindowProcW PostMessageW SendMessageW DispatchMessageW TranslateMessage BeginPaint GetMessageW

gdi32

MoveToEx SetTextColor SetBkMode SetBkColor SelectObject RoundRect LineTo GetStockObject DeleteObject DeleteDC CreateSolidBrush CreatePen CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap BitBlt

comctl32

ord412 ord410 InitCommonControlsEx ord413

shell32

SHGetKnownFolderPath ShellExecuteExW CommandLineToArgvW ShellExecuteW SHCreateDirectoryExW

shlwapi

PathFileExistsW

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetTimeouts WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect

wininet

InternetCloseHandle InternetOpenUrlW InternetReadFile InternetSetOptionW HttpQueryInfoW InternetOpenW

ole32

CoCreateInstance CoTaskMemFree CoInitializeEx CoUninitialize

oleaut32

VariantInit SysAllocString VariantClear

dwmapi

DwmSetWindowAttribute

gdiplus

GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCreatePath GdipDeletePath GdipClosePathFigure GdipAddPathArc GdipAddPathRectangle GdipAddPathEllipse GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipCreateLineBrushFromRect GdipCreatePathGradientFromPath GdipSetPathGradientCenterColor GdipSetPathGradientSurroundColorsWithCount GdipGetPathGradientPointCount GdipCreatePen1 GdipDeletePen GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetPixelOffsetMode GdipSetTextRenderingHint GdipDrawLine GdipDrawRectangle GdipDrawPath GdipFillRectangle GdipFillPolygon GdipFillEllipse GdipFillPath GdipSetClipRectI GdipSaveGraphics GdipRestoreGraphics GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipDrawString GdipMeasureString GdipCreateStringFormat GdipDeleteStringFormat GdipSetStringFormatFlags

advapi32

CheckTokenMembership QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW RegEnumKeyExW RegCloseKey FreeSid AllocateAndInitializeSid

wevtapi

EvtQuery EvtOpenPublisherMetadata EvtFormatMessage EvtRender EvtNext EvtClose

wintrust

WinVerifyTrust

kernel32

IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetProcAddress GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary UnhandledExceptionFilter CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader HeapFree HeapReAlloc HeapAlloc GetFileType VirtualProtect LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP ExitThread FindFirstFileExW InitializeSListHead GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW LCMapStringEx GetCPInfo CompareStringEx DecodePointer GetCommandLineA QueryPerformanceCounter DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLogicalProcessorInformationEx GetExitCodeThread WaitForSingleObjectEx Process32NextW Process32FirstW CreateToolhelp32Snapshot WideCharToMultiByte MultiByteToWideChar SystemTimeToFileTime FileTimeToSystemTime SystemTimeToTzSpecificLocalTime MoveFileExW MoveFileW QueryFullProcessImageNameW FormatMessageW LocalFree GlobalFree GlobalLock GlobalUnlock GlobalAlloc GetModuleFileNameW GetWindowsDirectoryW GetSystemDirectoryW GetTickCount64 GetTickCount GetSystemTimeAsFileTime OpenProcess CreateProcessW GetCurrentThreadId GetExitCodeProcess TerminateProcess ExitProcess GetCurrentProcessId GetProcessTimes Sleep WaitForSingleObject PeekNamedPipe CreatePipe GetLastError SetHandleInformation CloseHandle GetTempPathW WriteFile SetFilePointerEx SetFileAttributesW RemoveDirectoryW ReadFile QueryDosDeviceW GetLogicalDriveStringsW GetFullPathNameW GetFileSizeEx GetFileAttributesExW GetFileAttributesW FindNextFileW FindFirstFileW FindClose FileTimeToLocalFileTime DeleteFileW CreateFileW ExpandEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW EncodePointer GetStdHandle

Name

.text

Size

789KB

Virtual Size

788KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

318KB

Virtual Size

317KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_0c273b22168a2610fc95af914b33c8cd_cobalt-strike_icedid_njrat_satacom_stealc

user32

gdi32

comctl32

shell32

shlwapi

winhttp

wininet

ole32

oleaut32

dwmapi

gdiplus

advapi32

wevtapi

wintrust

kernel32

generic