2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc
Size 33.5MB
Sample260815-1a2mmsgq6x
SHA256 e200a997756a140555d8cc9db17a641fd2cb7cef7291e1fb11109253cede1ba3
MD5 b871aabc7f4c9554f9832e01653b2077
SHA1 3d551366af066f59cb687dcedb9a08d142b0d037
SHA512 8f500f89f3132725942fee852d1507055880b163cf51fa29226ca0b7806f5a111cddf930174aec3ae476d3b4df180b7406260c0cb8c27e7dbb6722310dea59e2
SSDEEP 786432:Az8rxl0vX27zo1RdApDqz/gfC2Q/FgtXeLweHEa0lSMNm:A8xQT1TApDqzX2QNgeweka0l/m
TLSH
T18177332BA2AA01BCD06FC13A99769502EA73B8101B319DCB47D0C9A95F376F11E3F751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

installer

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc

Inno Setup is an open-source installation builder for Windows applications. 1 IoCs

Inno Setup installer

installer

resource	yara_rule
sample	innosetup

File Explorer

2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc

.exe 33.5MB

2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc

IMPHASH 40fb7e7ff3cd5f9e974b7344d29eec3f
SHA256 e200a997756a140555d8cc9db17a641fd2cb7cef7291e1fb11109253cede1ba3
MD5 b871aabc7f4c9554f9832e01653b2077
SHA1 3d551366af066f59cb687dcedb9a08d142b0d037
SHA512 8f500f89f3132725942fee852d1507055880b163cf51fa29226ca0b7806f5a111cddf930174aec3ae476d3b4df180b7406260c0cb8c27e7dbb6722310dea59e2
SSDEEP 786432:Az8rxl0vX27zo1RdApDqz/gfC2Q/FgtXeLweHEa0lSMNm:A8xQT1TApDqzX2QNgeweka0l/m
TLSH
T18177332BA2AA01BCD06FC13A99769502EA73B8101B319DCB47D0C9A95F376F11E3F751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.
Inno Setup is an open-source installation builder for Windows applications.

Inno Setup installer

installer

Minor OS version

Major OS version

Entry point

1158544

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\A\Desktop\2bane-master\2bane-master\bane_client\x64\Release\Dosoft.pdb

kernel32

WideCharToMultiByte GetTickCount GetLastError LocalFree LoadLibraryW GetProcAddress FreeLibrary SetDllDirectoryW ReadFile CreateFileW GetSystemInfo WaitForSingleObject CreateProcessA GetExitCodeProcess GetVolumeInformationA GetLocaleInfoA GetNativeSystemInfo GlobalMemoryStatusEx GetComputerNameA Sleep CreateThread SizeofResource GetModuleFileNameW LockResource LoadResource FindResourceW CreateProcessW GetModuleHandleW AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetCurrentProcessId CreateMutexW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize FormatMessageW GetDiskFreeSpaceA GetFileAttributesExW OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc RaiseException HeapAlloc HeapCompact HeapDestroy UnlockFile LockFileEx GetFileSize DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter FlushFileBuffers SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetFileAttributesA MultiByteToWideChar RtlUnwind GetEnvironmentVariableA SetUnhandledExceptionFilter GetLocalTime CloseHandle CreateFileA GetTempPathA InitializeCriticalSection LeaveCriticalSection WriteFile UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind EnterCriticalSection WriteConsoleW GetTempPathW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileSizeEx TerminateProcess CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle GetFinalPathNameByHandleW SetFileInformationByHandle CreateFile2 DeviceIoControl CopyFile2 GetFileInformationByHandleEx CreateSymbolicLinkW GetLocaleInfoEx InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetCPInfo GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetStartupInfoW InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetCurrentProcess ExitProcess GetStdHandle RtlCaptureContext GetFileType

user32

GetSystemMetrics

advapi32

CryptReleaseContext RegOpenKeyExA RegQueryValueExA RegCloseKey GetUserNameA RegEnumKeyExA CryptDestroyKey CryptAcquireContextA CryptDecrypt CryptCreateHash CryptHashData CryptDestroyHash CryptSetKeyParam CryptImportKey CryptGetHashParam

crypt32

CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptHashData BCryptDestroyHash BCryptFinishHash BCryptDeriveKeyPBKDF2 BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptImportKey BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptCreateHash

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpAddRequestHeaders WinHttpOpenRequest

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

220KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

31.9MB

Virtual Size

31.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_b871aabc7f4c9554f9832e01653b2077_cobalt-strike_darkgate_gcleaner_icedid_njrat_satacom_stealc

kernel32

user32

advapi32

crypt32

bcrypt

winhttp

generic