2026-07-06_32467766619931f1a5a8460760eaaa0b_cobalt-strike_icedid_njrat_remcos_rhadamanthys_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_32467766619931f1a5a8460760eaaa0b_cobalt-strike_icedid_njrat_remcos_rhadamanthys_satacom
Size 3.3MB
Sample260707-e5vxpaez2l
SHA256 eb7a6eeef53aa0222092f9038007bc8ae2676c6c44747199c900a2f428a3cf65
MD5 32467766619931f1a5a8460760eaaa0b
SHA1 9e8178848b83d1665ed72361cbffccaa491b2cc2
SHA512 a4e63807bd2f1dbf30e79bac19df7ebf0819673f2e97bef5bf5a47d26441bf1dd7187adb15ff1581b3aa8fea6737f7403eed545c72ef0b8b3e1e8b0d1fb29c32
SSDEEP 49152:iopXMwMFBk6U0dbt/J2tD2upzzBrW/m0qMCWXfLYBKfd2LDZLFaLKmMG0ZCCV:5XM9vNohzzBrWlqMcyd8LuKme
TLSH
T1B5F5AE45F3FE44E8E9A6D07DC5275A1FDBB1BC510231C29F01A18B5A6F332624E3A366
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-06_32467766619931f1a5a8460760eaaa0b_cobalt-strike_icedid_njrat_remcos_rhadamanthys_satacom

File Explorer

2026-07-06_32467766619931f1a5a8460760eaaa0b_cobalt-strike_icedid_njrat_remcos_rhadamanthys_satacom

.exe 3.3MB

2026-07-06_32467766619931f1a5a8460760eaaa0b_cobalt-strike_icedid_njrat_remcos_rhadamanthys_satacom

IMPHASH 4dcfb076500f538a9b811da7606157a1
SHA256 eb7a6eeef53aa0222092f9038007bc8ae2676c6c44747199c900a2f428a3cf65
MD5 32467766619931f1a5a8460760eaaa0b
SHA1 9e8178848b83d1665ed72361cbffccaa491b2cc2
SHA512 a4e63807bd2f1dbf30e79bac19df7ebf0819673f2e97bef5bf5a47d26441bf1dd7187adb15ff1581b3aa8fea6737f7403eed545c72ef0b8b3e1e8b0d1fb29c32
SSDEEP 49152:iopXMwMFBk6U0dbt/J2tD2upzzBrW/m0qMCWXfLYBKfd2LDZLFaLKmMG0ZCCV:5XM9vNohzzBrWlqMcyd8LuKme
TLSH
T1B5F5AE45F3FE44E8E9A6D07DC5275A1FDBB1BC510231C29F01A18B5A6F332624E3A366
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

db:b5:72:b1:05:c8:be:02:9d:7d:af:b0:0d:7c:9f:2c:9d:df:7c:f5:06:11:fd:9a:4c:43:94:1a:55:55:86:1f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=0313374363,CN=568E ENTERTAINMENT CORPORATION,O=568E ENTERTAINMENT CORPORATION,ST=Ho Chi Minh,C=VN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#1310486f20436869204d696e682043697479,1.3.6.1.4.1.311.60.2.1.2=#130b486f20436869204d696e68,1.3.6.1.4.1.311.60.2.1.3=#1302564e

Chains

Jan 1, 0001

Subject

CN=Sectigo Public Code Signing CA EV E36,O=Sectigo Limited,C=GB

Serial Number

37:74:43:4f:9e:b4:0e:22:1f:92:36:ca:1f:2f:27:17

Issuer

CN=Sectigo Public Code Signing Root E46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Code Signing Root E46,O=Sectigo Limited,C=GB

Serial Number

d5:b3:60:02:89:59:a2:7f:84:65:c9:e6:b1:8d:ba:cb

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 28, 2023 - Dec 31, 2028

Subject

Serial Number

b2:ee:ec:1f:28:9f:5c:98:b5:a8:d7:be:c9:ad:60:a1

Issuer

CN=Sectigo Public Code Signing CA EV E36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 15, 2025 - May 14, 2028

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1803984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\launcher\x64\Public\Launcher.pdb

kernel32

ExitProcess GetStdHandle GetFileType SetStdHandle QueryPerformanceFrequency HeapQueryInformation FreeLibraryAndExitThread ExitThread GetCommandLineW GetCommandLineA VirtualQuery VirtualAlloc GetSystemInfo IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetConsoleOutputCP FlsAlloc RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry CreateProcessW GetLocalTime RemoveDirectoryW lstrlenW FindNextFileW RaiseException OutputDebugStringW IsDebuggerPresent LCMapStringW FlsFree GetTimeZoneInformation FindFirstFileExW IsValidCodePage SetFilePointerEx GetConsoleMode FlsGetValue GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW WriteConsoleW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReadConsoleW ReleaseSRWLockExclusive GetTempFileNameW FindResourceExW GetWindowsDirectoryW SearchPathW GetProfileIntW Sleep GetTickCount64 SystemTimeToTzSpecificLocalTime SetFileTime GetFileTime GetFileSizeEx GetFileAttributesExW FileTimeToLocalFileTime SetErrorMode lstrcmpiW GetCurrentProcess DuplicateHandle WriteFile UnlockFile SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW FlushFileBuffers FindFirstFileW FindClose GetTempPathW SetFilePointer VirtualProtect GetFileSize CreateFileW GetThreadLocale FileTimeToSystemTime GlobalGetAtomNameW GlobalFlags GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW GetCurrentDirectoryW LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection InitializeCriticalSectionAndSpinCount WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW VerifyVersionInfoW VerSetConditionMask CompareStringW GlobalFindAtomW GlobalAddAtomW GetSystemDirectoryW EncodePointer ResumeThread SetThreadPriority lstrcpyW GetCurrentProcessId WideCharToMultiByte MultiByteToWideChar QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW lstrcmpW lstrcmpA GlobalDeleteAtom LoadLibraryW LoadLibraryExW GetModuleHandleExW FreeLibrary GetVersionExW GetCurrentThreadId GetCurrentThread OutputDebugStringA SetLastError CloseHandle CopyFileW FormatMessageW MulDiv LocalFree GlobalSize GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc HeapReAlloc HeapSize HeapFree GetFileAttributesW SetFileAttributesW DeleteFileW GetProcAddress GetModuleHandleW GlobalUnlock GlobalFree GlobalLock GlobalAlloc InitializeCriticalSectionEx EnterCriticalSection LeaveCriticalSection WaitForSingleObject MoveFileExW CreateThread FindResourceW LoadResource LockResource SizeofResource CreateDirectoryW SetCurrentDirectoryW GetModuleFileNameW GetLastError CreateMutexW FlsSetValue RtlUnwind

user32

MapVirtualKeyW GetKeyNameTextW LoadMenuW GetWindowDC TabbedTextOutW GrayStringW DrawTextExW DrawTextW IntersectRect IsDialogMessageW SetWindowTextW CheckDlgButton MoveWindow ShowWindow SendDlgItemMessageA ShowOwnedPopups LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem EnumDisplayMonitors SystemParametersInfoW SetRectEmpty GetMonitorInfoW MonitorFromWindow WinHelpW GetScrollInfo SetScrollInfo UnhookWindowsHookEx GetTopWindow GetClassNameW GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW PtInRect EqualRect CopyRect ScreenToClient AdjustWindowRectEx GetWindowTextLengthW GetWindowTextW RemovePropW GetPropW SetPropW ShowScrollBar GetScrollRange SetScrollRange GetScrollPos SetScrollPos ScrollWindow EndPaint BeginPaint SetForegroundWindow GetForegroundWindow TrackPopupMenu SetMenu GetMenu GetCapture SetFocus GetDlgCtrlID IsIconic EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPlacement GetWindowPlacement IsChild IsMenu LockWindowUpdate DestroyMenu EnableScrollBar GetDoubleClickTime GetMessageW TranslateMessage DispatchMessageW UnregisterClassW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW GetMessageTime GetMessagePos CallNextHookEx SetWindowsHookExW ValidateRect GetKeyState PeekMessageW GetDesktopWindow DeleteMenu GetActiveWindow RealChildWindowFromPoint SetTimer KillTimer CharNextW SetCapture CreatePopupMenu CopyAcceleratorTableW InvalidateRgn SetRect GetNextDlgGroupItem MessageBeep OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetNextDlgTabItem GetDlgItem DestroyIcon MonitorFromPoint IsZoomed CharUpperW GetAsyncKeyState GetSystemMenu NotifyWinEvent SetCursorPos UnionRect CopyImage LoadIconW SendMessageW GetParent SetParent GetWindowLongW GetClientRect GetWindowRect SetLayeredWindowAttributes PostQuitMessage PostMessageW GetWindow SetWindowRgn wsprintfW EnableWindow ReleaseCapture IsWindow LoadImageW DefWindowProcW LoadCursorW RegisterClassExW GetDC UpdateLayeredWindow ReleaseDC MapWindowPoints TrackMouseEvent ClientToScreen WindowFromPoint InvalidateRect GetCursorPos SetCursor DestroyCursor OffsetRect InflateRect UpdateWindow GetMenuStringW GetMenuState DrawMenuBar GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuW AppendMenuW RemoveMenu SetWindowPos SetWindowContextHelpId MapDialogRect IsWindowEnabled MessageBoxW GetWindowThreadProcessId GetLastActivePopup RegisterWindowMessageW DrawEdge DrawFrameControl IsWindowVisible GetFocus GetSystemMetrics DrawStateW RedrawWindow GetSysColor GetSysColorBrush DrawFocusRect FillRect IsRectEmpty DrawIconEx DestroyWindow CreateDialogIndirectParamW EndDialog GetIconInfo CopyIcon GetMenuItemInfoW GetMenuDefaultItem BringWindowToTop SetMenuDefaultItem ModifyMenuW DestroyAcceleratorTable SetClassLongPtrW GetUpdateRect ToUnicodeEx GetKeyboardLayout GetKeyboardState LoadAcceleratorsW CreateAcceleratorTableW RegisterClipboardFormatW SubtractRect CharUpperBuffW TranslateAcceleratorW InsertMenuItemW UnpackDDElParam ReuseDDElParam FrameRect IsClipboardFormatAvailable PostThreadMessageW WaitMessage IsCharLowerW MapVirtualKeyExW SetActiveWindow GetWindowRgn DrawIcon InvertRect HideCaret CreateMenu GetComboBoxInfo TranslateMDISysAccel DefFrameProcW DefMDIChildProcW

gdi32

Ellipse GetBkColor GetTextColor GetTextExtentPoint32W PatBlt ExtTextOutW CreatePolygonRgn Polygon Polyline GetTextMetricsW SetBkColor SetTextColor CreateDIBitmap CreateFontIndirectW CreatePen CreatePatternBrush EnumFontFamiliesW GetTextCharsetInfo CreateBitmap SetRectRgn DPtoLP Escape ExcludeClipRect GetClipBox GetObjectType GetPixel GetViewportExtEx GetWindowExtEx IntersectClipRect LineTo PtVisible RectVisible RestoreDC SaveDC SelectClipRgn ExtSelectClipRgn SelectPalette SetBkMode SetMapMode SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign CreateSolidBrush MoveToEx TextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx OffsetViewportOrgEx OffsetWindowOrgEx ScaleViewportExtEx ScaleWindowExtEx GetRgnBox RealizePalette SetPixel StretchBlt CreateRoundRectRgn Rectangle OffsetRgn RoundRect CreatePalette GetPaletteEntries GetNearestPaletteIndex GetSystemPaletteEntries EnumFontFamiliesExW LPtoDP ExtFloodFill SetPaletteEntries FillRgn FrameRgn GetBoundsRect PtInRegion GetViewportOrgEx GetWindowOrgEx SetPixelV GetTextFaceW CreateRectRgnIndirect CreateHatchBrush CreateEllipticRgn GetDeviceCaps CreateDCW CopyMetaFileW GetStockObject CreateFontW CreateCompatibleBitmap BitBlt CreateDIBSection CreateCompatibleDC SetDIBColorTable SelectObject DeleteDC GetObjectW DeleteObject CombineRgn GetMapMode CreateRectRgn

msimg32

AlphaBlend TransparentBlt

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegQueryValueW RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegEnumKeyExW RegEnumValueW RegCloseKey RegEnumKeyW RegSetValueExW RegDeleteValueW RegDeleteKeyW

shell32

SHGetDesktopFolder SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation SHBrowseForFolderW SHAppBarMessage SHGetFileInfoW ShellExecuteW DragQueryFileW DragFinish SHGetFolderPathW

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsW StrFormatByteSizeW PathFindExtensionW PathRemoveFileSpecW PathIsUNCW PathStripToRootW StrFormatKBSizeW PathFindFileNameW StrChrW

uxtheme

GetThemePartSize GetThemeSysColor IsAppThemed OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetCurrentThemeName DrawThemeParentBackground DrawThemeText GetWindowTheme IsThemeBackgroundPartiallyTransparent

ole32

OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator CoRevokeClassObject CoRegisterMessageFilter OleCreateMenuDescriptor CoGetClassObject OleLockRunning RevokeDragDrop RegisterDragDrop CoLockObjectExternal OleGetClipboard DoDragDrop OleIsCurrentClipboard OleFlushClipboard OleUninitialize OleInitialize CoFreeUnusedLibraries CreateILockBytesOnHGlobal StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CoDisconnectObject CoInitialize CoCreateInstance CLSIDFromProgID CLSIDFromString CoCreateGuid ReleaseStgMedium OleDuplicateData CoTaskMemFree CoTaskMemAlloc CreateStreamOnHGlobal CoInitializeEx CoUninitialize

oleaut32

VariantTimeToSystemTime SystemTimeToVariantTime LoadTypeLi SysStringLen VariantChangeType VariantClear VariantInit SysAllocStringLen SysFreeString SysAllocString SafeArrayDestroy VariantCopy VarBstrFromDate OleCreateFontIndirect

oledlg

OleUIBusyW

gdiplus

GdipClosePathFigure GdipDeletePath GdipCreatePath GdipCreateFromHDC GdipSetCompositingMode GdipSetCompositingQuality GdipSetSmoothingMode GdipSetPixelOffsetMode GdipCreateSolidFill GdipDeleteBrush GdipFillPath GdipSetClipPath GdipResetClip GdipCreatePen1 GdipDeletePen GdipDrawPath GdipAddPathArc GdipCreateBitmapFromHBITMAP GdipSetInterpolationMode GdipDrawImageRectI GdipAddPathEllipse GdiplusStartup GdiplusShutdown GdipDrawImageI GdipDeleteGraphics GdipGetImageGraphicsContext GdipDisposeImage GdipFree GdipAlloc GdipCloneImage GdipCreateBitmapFromStream GdipGetImagePixelFormat GdipCreateBitmapFromScan0 GdipBitmapUnlockBits GdipGetImageHeight GdipGetImageWidth GdipBitmapLockBits GdipGetImagePaletteSize GdipGetImagePalette

oleacc

AccessibleObjectFromWindow LresultFromObject CreateStdAccessibleObject

imm32

ImmReleaseContext ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

winhttp

WinHttpQueryHeaders WinHttpCrackUrl WinHttpConnect WinHttpOpenRequest WinHttpReceiveResponse WinHttpOpen WinHttpSendRequest WinHttpCloseHandle WinHttpAddRequestHeaders WinHttpReadData

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

582KB

Virtual Size

582KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

581KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

93KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

662KB

Virtual Size

662KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_32467766619931f1a5a8460760eaaa0b_cobalt-strike_icedid_njrat_remcos_rhadamanthys_satacom

PE Signature issue

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

oleacc

imm32

winmm

winhttp

generic