2026-07-18_4f7d1f7222d1feeffbcc19ae7ce79d3a_cobalt-strike_coinminer_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-18_4f7d1f7222d1feeffbcc19ae7ce79d3a_cobalt-strike_coinminer_icedid_njrat_satacom_stealc
Size 9.4MB
Sample260718-ngs8macz8x
SHA256 8aca9976c783df73e1bedc6be52a3e27ac2ce21e2918f13b665b01e3ccef59ea
MD5 4f7d1f7222d1feeffbcc19ae7ce79d3a
SHA1 6c5e1c6986ffb1aed07f4aed5d56f7b4a39db25a
SHA512 e8f9503ad5d0c8b2e7a5b81801fefe1a0548424b3eb4c3ee32744cf659f233d7e06eb6de5ba1ba53d83194557b60af1977f51e32e4deaed2db2ed5407e1fa49e
SSDEEP 49152:3srYiyXyDhbp3I4lbmENAsEsLeZrWnJ4HFW952qyCO1IkeStMBJZsx4z9x4X4Enu:+dbZF5mENAsEY9vb2FCqgCksx4Tj
TLSH
T12FA6BEB5A14C4E6BE466B078C1A34653DBF0BF0A2760CFD6B6CC7C470BAF0D4692495A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-18_4f7d1f7222d1feeffbcc19ae7ce79d3a_cobalt-strike_coinminer_icedid_njrat_satacom_stealc

File Explorer

2026-07-18_4f7d1f7222d1feeffbcc19ae7ce79d3a_cobalt-strike_coinminer_icedid_njrat_satacom_stealc

.exe 9.4MB

2026-07-18_4f7d1f7222d1feeffbcc19ae7ce79d3a_cobalt-strike_coinminer_icedid_njrat_satacom_stealc

IMPHASH 4b8fdbbea2aff4b0d42268ab23df059c
SHA256 8aca9976c783df73e1bedc6be52a3e27ac2ce21e2918f13b665b01e3ccef59ea
MD5 4f7d1f7222d1feeffbcc19ae7ce79d3a
SHA1 6c5e1c6986ffb1aed07f4aed5d56f7b4a39db25a
SHA512 e8f9503ad5d0c8b2e7a5b81801fefe1a0548424b3eb4c3ee32744cf659f233d7e06eb6de5ba1ba53d83194557b60af1977f51e32e4deaed2db2ed5407e1fa49e
SSDEEP 49152:3srYiyXyDhbp3I4lbmENAsEsLeZrWnJ4HFW952qyCO1IkeStMBJZsx4z9x4X4Enu:+dbZF5mENAsEY9vb2FCqgCksx4Tj
TLSH
T12FA6BEB5A14C4E6BE466B078C1A34653DBF0BF0A2760CFD6B6CC7C470BAF0D4692495A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

300928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

recv connect socket WSACleanup closesocket getaddrinfo WSAStartup send freeaddrinfo

winhttp

WinHttpSendRequest WinHttpConnect WinHttpCloseHandle WinHttpReceiveResponse WinHttpOpen WinHttpOpenRequest WinHttpSetOption

kernel32

GetCommandLineW FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage GetModuleFileNameA Process32First SetPriorityClass GetCurrentProcess WriteFile TerminateProcess CreateMutexA WaitForSingleObject UnmapViewOfFile OpenProcess GetCommandLineA CreateToolhelp32Snapshot Sleep GetTempPathA CopyFileA GetLastError OpenMutexA MoveFileExA QueryFullProcessImageNameA GetEnvironmentStringsW DeleteFileA Process32Next CloseHandle SetFileAttributesA CreateFileMappingA WTSGetActiveConsoleSessionId ExitProcess GetCurrentProcessId CreateProcessA CreateDirectoryA MapViewOfFile GetLogicalProcessorInformation OpenFileMappingA VirtualAlloc VirtualProtect VirtualFree GetLargePageMinimum HeapQueryInformation HeapSize HeapReAlloc GetTimeZoneInformation ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW SetEndOfFile WriteConsoleW CreateFileA IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW HeapFree HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread GetLogicalProcessorInformationEx QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime RtlUnwind ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WideCharToMultiByte WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetProcAddress GetModuleFileNameW GetStdHandle RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter

user32

SetProcessDPIAware FindWindowA GetForegroundWindow GetDesktopWindow GetShellWindow GetWindowThreadProcessId

shell32

SHGetFolderPathA ShellExecuteExA

advapi32

AdjustTokenPrivileges CreateProcessAsUserA SetTokenInformation AllocateAndInitializeSid LookupPrivilegeValueA OpenProcessToken FreeSid CheckTokenMembership DuplicateTokenEx

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

secur32

DeleteSecurityContext AcquireCredentialsHandleA InitializeSecurityContextA QueryContextAttributesA ApplyControlToken FreeContextBuffer FreeCredentialsHandle DecryptMessage EncryptMessage

Name

.text

Size

477KB

Virtual Size

476KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8.9MB

Virtual Size

8.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-18_4f7d1f7222d1feeffbcc19ae7ce79d3a_cobalt-strike_coinminer_icedid_njrat_satacom_stealc

ws2_32

winhttp

kernel32

user32

shell32

advapi32

wtsapi32

userenv

secur32

generic