2026-08-30_0328b35c67c07d02053f0b62534343e3_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-30_0328b35c67c07d02053f0b62534343e3_cobalt-strike_icedid_njrat_satacom_stealc
Size 7.1MB
Sample260830-2dsdta1eqd
SHA256 f14314ce4edd918a75368c6eb18c4f63ac40783f6130328195cafc6c39f4fd37
MD5 0328b35c67c07d02053f0b62534343e3
SHA1 e25f6558718703d4296c0000a7ccb79ef74c6203
SHA512 87b795ae92e51b82bfb163dbec11d781082d69f5c3d78a4bb2f79063879d09f481477267012457083235e45c8685c950eb2d4b46b383cf5eecd5de9e222d34d3
SSDEEP 98304:nnqZOKtTwzcxgYkd6H0/5lKhjrndk1pKy:nqZFaoxnH0xUVrdk1p
TLSH
T1DB76E007F36343AEC17299388EA2C312F771BC505B25A3CB76842A699E9B1F41DF56D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-30_0328b35c67c07d02053f0b62534343e3_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-30_0328b35c67c07d02053f0b62534343e3_cobalt-strike_icedid_njrat_satacom_stealc

.exe 7.1MB

2026-08-30_0328b35c67c07d02053f0b62534343e3_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 0080586c148466867d86878f68c356ff
SHA256 f14314ce4edd918a75368c6eb18c4f63ac40783f6130328195cafc6c39f4fd37
MD5 0328b35c67c07d02053f0b62534343e3
SHA1 e25f6558718703d4296c0000a7ccb79ef74c6203
SHA512 87b795ae92e51b82bfb163dbec11d781082d69f5c3d78a4bb2f79063879d09f481477267012457083235e45c8685c950eb2d4b46b383cf5eecd5de9e222d34d3
SSDEEP 98304:nnqZOKtTwzcxgYkd6H0/5lKhjrndk1pKy:nqZFaoxnH0xUVrdk1p
TLSH
T1DB76E007F36343AEC17299388EA2C312F771BC505B25A3CB76842A699E9B1F41DF56D0
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

564336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

shell32

ShellExecuteA CommandLineToArgvW

kernel32

GetProcAddress VirtualAllocEx CreateRemoteThread VirtualFreeEx GetCommandLineW GetModuleFileNameW MultiByteToWideChar DeleteFileW LocalFree MoveFileExW GetCurrentProcessId CreateProcessW GetModuleHandleW CopyFileW SizeofResource WriteFile GetEnvironmentVariableW GetTempPathW CreateFileW GetModuleHandleA GetTickCount64 LockResource LoadResource FindResourceW GetConsoleWindow GetTempFileNameW FlushFileBuffers GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileSizeEx GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW LoadLibraryA HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle TerminateProcess ExitProcess IsProcessorFeaturePresent ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer WaitForSingleObject WriteProcessMemory MapViewOfFile CreateFileMappingW GetLastError UnmapViewOfFile OpenFileMappingW OutputDebugStringA GetExitCodeProcess CloseHandle Sleep OpenProcess GetCurrentProcess GetCommandLineA RtlUnwind EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepConditionVariableSRW WakeAllConditionVariable GetProcessHeap GetEnvironmentStringsW FreeEnvironmentStringsW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetLocaleInfoEx GetFileInformationByHandleEx SetStdHandle HeapSize WriteConsoleW SetEndOfFile VirtualProtect GetCurrentThreadId FormatMessageA CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW CreateFile2 AreFileApisANSI

user32

MessageBoxA EndPaint BeginPaint InvalidateRect UpdateWindow DrawTextW GetClientRect LoadCursorW TranslateMessage PeekMessageW DispatchMessageW ShowWindow RegisterClassExW GetSystemMetrics SendMessageW GetKeyState LoadCursorA ScreenToClient ClientToScreen TrackMouseEvent SetCursor SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetWindowThreadProcessId GetWindow DispatchMessageA GetWindowRect IsWindowVisible SetWindowPos SetWindowRgn UnregisterClassW GetClassNameA IsWindow GetKeyNameTextA GetAsyncKeyState GetCapture MapVirtualKeyA GetTopWindow GetForegroundWindow SetCapture PeekMessageA PostQuitMessage ReleaseCapture LoadImageW GetCursorPos DefWindowProcW DestroyWindow MessageBoxW FillRect CreateWindowExW

gdi32

DeleteObject GetStockObject SetBkMode SetTextColor CreateSolidBrush SelectObject CreateRectRgn

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

bcrypt

BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptGetProperty BCryptHashData BCryptCreateHash

comctl32

InitCommonControlsEx

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts

imm32

ImmAssociateContextEx ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

Name

.text

Size

743KB

Virtual Size

742KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-30_0328b35c67c07d02053f0b62534343e3_cobalt-strike_icedid_njrat_satacom_stealc

d3d11

d3dcompiler_47

shell32

kernel32

user32

gdi32

advapi32

bcrypt

comctl32

winhttp

imm32

generic