2026-08-09_690919ffe94eff16f9bdd7d33338e19d_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_690919ffe94eff16f9bdd7d33338e19d_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc
Size 33.4MB
Sample260809-jnqc4abp21
SHA256 7ae88fcc9b9b63f4831c0b7e1850f01014a560423984af267d295233047fe34b
MD5 690919ffe94eff16f9bdd7d33338e19d
SHA1 cceb065ffa0c1d08d9bc21e586a949de0c57e8ac
SHA512 f75439df33fa9cf194162dc43ae85a685c18adc42dff61ee1a3fcabd43641cc1c4fb312a13187d312fd6d2e8f668b2932034528fce4e76c4f4eb2e98db02628e
SSDEEP 786432:7o8rxl0vX27zo1RdApDqz/gfC2Q/FgtXeLweHEa0lSMNm:7vxQT1TApDqzX2QNgeweka0l/m
TLSH
T1C077332BA26A01BCD06BC23A99768502EA73B8111F3199CB57D0C99D5F336F11E3F761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

installer

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_690919ffe94eff16f9bdd7d33338e19d_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
sample	innosetup

File Explorer

2026-08-09_690919ffe94eff16f9bdd7d33338e19d_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc

.exe 33.4MB

2026-08-09_690919ffe94eff16f9bdd7d33338e19d_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc

IMPHASH 777d7dd9ecfd9043edc204e0701da63c
SHA256 7ae88fcc9b9b63f4831c0b7e1850f01014a560423984af267d295233047fe34b
MD5 690919ffe94eff16f9bdd7d33338e19d
SHA1 cceb065ffa0c1d08d9bc21e586a949de0c57e8ac
SHA512 f75439df33fa9cf194162dc43ae85a685c18adc42dff61ee1a3fcabd43641cc1c4fb312a13187d312fd6d2e8f668b2932034528fce4e76c4f4eb2e98db02628e
SSDEEP 786432:7o8rxl0vX27zo1RdApDqz/gfC2Q/FgtXeLweHEa0lSMNm:7vxQT1TApDqzX2QNgeweka0l/m
TLSH
T1C077332BA26A01BCD06BC23A99768502EA73B8111F3199CB57D0C99D5F336F11E3F761
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.
Inno Setup is an open-source installation builder for Windows applications.

Inno Setup installer

installer

Minor OS version

Major OS version

Entry point

1126080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\A\Downloads\Telegram Desktop\2bane_stealer-master\2bane-master\bane_client\x64\Release\Dosoft.pdb

kernel32

WideCharToMultiByte GetTickCount GetLastError LocalFree LoadLibraryW GetProcAddress FreeLibrary SetDllDirectoryW ReadFile CreateFileW GetVolumeInformationA GetLocaleInfoA GetNativeSystemInfo GlobalMemoryStatusEx GetComputerNameA Sleep CreateThread SizeofResource GetModuleFileNameW LockResource LoadResource FindResourceW CreateProcessW GetModuleHandleW AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject GetCurrentProcessId GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize FormatMessageW GetDiskFreeSpaceA GetFileAttributesExW OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc RaiseException GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile LockFileEx GetFileSize DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter FlushFileBuffers SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetFileAttributesA MultiByteToWideChar GetEnvironmentVariableA SetUnhandledExceptionFilter GetLocalTime CloseHandle CreateFileA GetTempPathA InitializeCriticalSection LeaveCriticalSection WriteFile EnterCriticalSection GetCommandLineW GetCommandLineA GetOEMCP RtlUnwind WriteConsoleW GetFileAttributesW GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileSizeEx GetFileType UnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetExitCodeProcess CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 DeviceIoControl CopyFile2 GetFileInformationByHandleEx CreateSymbolicLinkW GetLocaleInfoEx InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetCPInfo GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess ExitProcess GetStdHandle RtlCaptureContext RtlVirtualUnwind

user32

GetSystemMetrics

advapi32

CryptHashData RegOpenKeyExA RegQueryValueExA GetUserNameA RegEnumKeyExA CryptDestroyKey CryptAcquireContextA CryptDecrypt CryptCreateHash CryptDestroyHash CryptSetKeyParam CryptImportKey CryptGetHashParam CryptReleaseContext RegCloseKey

shell32

ShellExecuteExW

crypt32

CryptStringToBinaryA CryptUnprotectData

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptImportKey BCryptDecrypt BCryptDestroyKey BCryptDeriveKeyPBKDF2 BCryptFinishHash BCryptHashData BCryptCreateHash BCryptGenerateSymmetricKey BCryptDestroyHash

winhttp

WinHttpSendRequest WinHttpOpen WinHttpReceiveResponse WinHttpCloseHandle WinHttpOpenRequest WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpConnect

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

216KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

31.9MB

Virtual Size

31.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_690919ffe94eff16f9bdd7d33338e19d_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

crypt32

bcrypt

winhttp

generic