2026-07-20_611ea6f92fad48c03796e726bb7492ec_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-07-20_611ea6f92fad48c03796e726bb7492ec_cobalt-strike_icedid_njrat_satacom_stealc
Size 19.5MB
Sample260720-lsdk7sdw7j
SHA256 0846d1abbd07e109eb60a7ead986c5e34bf5dc7f9c405944c0a8b4c8ba841a8a
MD5 611ea6f92fad48c03796e726bb7492ec
SHA1 3b1f8f5f46d5005882a89b87e4f77127cefaa7ea
SHA512 88b510ac3ba2f42ca0ac3ca7c3377047854b4405b3647378ef5060f5cee2d3f7a68b4d19f3330ec41a74205adbf41b6ba21fd61d777bf74b1f1a099394a0fc86
SSDEEP 393216:aasPNhyKUadp1xqB7ks2rt1IS7B+MvyLWcw3xFFKnVR2wW:fVCddqBur7I8+Mv4BY0b2wW
TLSH
T11F2712A765E067FCC419C0B4D10278FEF5A6B81D4BB9B266BBC72621BB33C14D464B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_611ea6f92fad48c03796e726bb7492ec_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-07-20_611ea6f92fad48c03796e726bb7492ec_cobalt-strike_icedid_njrat_satacom_stealc

.exe 19.5MB

2026-07-20_611ea6f92fad48c03796e726bb7492ec_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 6804043b94f600d8ff65da9a1e339778
SHA256 0846d1abbd07e109eb60a7ead986c5e34bf5dc7f9c405944c0a8b4c8ba841a8a
MD5 611ea6f92fad48c03796e726bb7492ec
SHA1 3b1f8f5f46d5005882a89b87e4f77127cefaa7ea
SHA512 88b510ac3ba2f42ca0ac3ca7c3377047854b4405b3647378ef5060f5cee2d3f7a68b4d19f3330ec41a74205adbf41b6ba21fd61d777bf74b1f1a099394a0fc86
SSDEEP 393216:aasPNhyKUadp1xqB7ks2rt1IS7B+MvyLWcw3xFFKnVR2wW:fVCddqBur7I8+Mv4BY0b2wW
TLSH
T11F2712A765E067FCC419C0B4D10278FEF5A6B81D4BB9B266BBC72621BB33C14D464B21
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

68272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\asus\Desktop\loader\x64\Release\loader.pdb

kernel32

GetModuleFileNameA CompareFileTime GetStdHandle SetConsoleMode SetCurrentConsoleFontEx CreateToolhelp32Snapshot GetConsoleMode Process32NextW CreateFileA Process32FirstW CloseHandle FreeConsole GetProcAddress ExitProcess SystemTimeToFileTime GlobalMemoryStatusEx GetModuleHandleW CreateProcessA GetDiskFreeSpaceExA AllocConsole SetConsoleTitleW GetFileTime GetComputerNameA SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA HeapReAlloc LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetLastError GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetConsoleCP IsProcessorFeaturePresent GetCurrentProcess TerminateProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW WriteFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree VirtualProtect LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP CreateFileW GetNumberOfConsoleInputEvents ReadConsoleInputW PeekConsoleInputA ReadConsoleW ReadFile IsValidCodePage GetACP GetOEMCP RtlUnwind

shell32

ShellExecuteA

urlmon

URLDownloadToFileA

wininet

InternetReadFile InternetOpenUrlA HttpQueryInfoA DeleteUrlCacheEntryA InternetTimeToSystemTimeA InternetOpenA InternetCloseHandle

Name

.text

Size

205KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19.2MB

Virtual Size

19.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_611ea6f92fad48c03796e726bb7492ec_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

shell32

urlmon

wininet

generic