2026-07-20_ae6e9ccb79a40e8f79ad1b9d167080bd_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-07-20_ae6e9ccb79a40e8f79ad1b9d167080bd_cobalt-strike_icedid_njrat_satacom_stealc
Size 19.0MB
Sample260720-emcndsev8m
SHA256 a9def2229786479c9e80c28082b3ed839eb9ef45a4510ed63c8f483c70bf776f
MD5 ae6e9ccb79a40e8f79ad1b9d167080bd
SHA1 f27f23ecacfe9e2f86ea118acb4b615445918034
SHA512 ac2793e55e3c8ed7e8b671b7400959a685be496bc5881f6c69c7c3407f0d349f4b8df6c52d6aa4b53d7063f243c9e9a22096c6c9a31933442eb13c468be96b90
SSDEEP 393216:zasPNhyKUadp1xqB7ks2rt1IS7B+MvyLWcw3xFFKnV:WVCddqBur7I8+Mv4BY0
TLSH
T14F171299A4D493BCC84A8034D5065EE9F0EA781E4FF8866B7FC659113B32C64C8B5B72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_ae6e9ccb79a40e8f79ad1b9d167080bd_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-20_ae6e9ccb79a40e8f79ad1b9d167080bd_cobalt-strike_icedid_njrat_satacom_stealc

.exe 19.0MB

2026-07-20_ae6e9ccb79a40e8f79ad1b9d167080bd_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 6804043b94f600d8ff65da9a1e339778
SHA256 a9def2229786479c9e80c28082b3ed839eb9ef45a4510ed63c8f483c70bf776f
MD5 ae6e9ccb79a40e8f79ad1b9d167080bd
SHA1 f27f23ecacfe9e2f86ea118acb4b615445918034
SHA512 ac2793e55e3c8ed7e8b671b7400959a685be496bc5881f6c69c7c3407f0d349f4b8df6c52d6aa4b53d7063f243c9e9a22096c6c9a31933442eb13c468be96b90
SSDEEP 393216:zasPNhyKUadp1xqB7ks2rt1IS7B+MvyLWcw3xFFKnV:WVCddqBur7I8+Mv4BY0
TLSH
T14F171299A4D493BCC84A8034D5065EE9F0EA781E4FF8866B7FC659113B32C64C8B5B72
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

68272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\asus\Desktop\loader\x64\Release\loader.pdb

kernel32

GetModuleFileNameA CompareFileTime GetStdHandle SetConsoleMode SetCurrentConsoleFontEx CreateToolhelp32Snapshot GetConsoleMode Process32NextW CreateFileA Process32FirstW CloseHandle FreeConsole GetProcAddress ExitProcess SystemTimeToFileTime GlobalMemoryStatusEx GetModuleHandleW CreateProcessA GetDiskFreeSpaceExA AllocConsole SetConsoleTitleW GetFileTime GetComputerNameA SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA HeapReAlloc LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetConsoleCP IsProcessorFeaturePresent GetCurrentProcess TerminateProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW WriteFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree VirtualProtect LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP CreateFileW GetNumberOfConsoleInputEvents ReadConsoleInputW PeekConsoleInputA ReadConsoleW ReadFile IsValidCodePage GetACP GetOEMCP RtlUnwind

shell32

ShellExecuteA

urlmon

URLDownloadToFileA

wininet

InternetReadFile InternetOpenUrlA HttpQueryInfoA DeleteUrlCacheEntryA InternetTimeToSystemTimeA InternetOpenA InternetCloseHandle

Name

.text

Size

205KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18.7MB

Virtual Size

18.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_ae6e9ccb79a40e8f79ad1b9d167080bd_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

shell32

urlmon

wininet

generic