2026-04-23_306ce46d74b575366193e073b6775de5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-23_306ce46d74b575366193e073b6775de5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 318KB
Sample260423-e87ewsaz31
SHA256 0665947056840b9833d7da70826d9d3030ff777363145fafffc1306c8d48f803
MD5 306ce46d74b575366193e073b6775de5
SHA1 08ff5aa7544a20384be777bcc7c870a1bce60be3
SHA512 cc3df79cb1d6ea659e2e1f307449ce4fb32a44dd794732be198d4b69b332d89378788f6932f875ac04529d75d27a7d37a38ef515c1799bff3e347f6b1e94a7ef
SSDEEP 6144:UUo/zjB/utJFWnK95crFoE2ZVpUP3a75DnNq:sx/utzWnKv+Fo5ZPaus
TLSH
T1C2648E29F66504FED1A7C1B9CA924E47E7717C4603B1AADB23E049A63F135E04E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-23_306ce46d74b575366193e073b6775de5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-04-23_306ce46d74b575366193e073b6775de5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 318KB

2026-04-23_306ce46d74b575366193e073b6775de5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 6e640942a7374320228c98c641a56b9d
SHA256 0665947056840b9833d7da70826d9d3030ff777363145fafffc1306c8d48f803
MD5 306ce46d74b575366193e073b6775de5
SHA1 08ff5aa7544a20384be777bcc7c870a1bce60be3
SHA512 cc3df79cb1d6ea659e2e1f307449ce4fb32a44dd794732be198d4b69b332d89378788f6932f875ac04529d75d27a7d37a38ef515c1799bff3e347f6b1e94a7ef
SSDEEP 6144:UUo/zjB/utJFWnK95crFoE2ZVpUP3a75DnNq:sx/utzWnKv+Fo5ZPaus
TLSH
T1C2648E29F66504FED1A7C1B9CA924E47E7717C4603B1AADB23E049A63F135E04E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

100632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\A\Desktop\远程桌面\客户端\x64\Release\客户端.pdb

ws2_32

freeaddrinfo recv connect socket send WSAStartup getaddrinfo select closesocket __WSAFDIsSet WSACleanup setsockopt

bcrypt

BCryptOpenAlgorithmProvider BCryptGenRandom BCryptFinishHash BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptGetProperty

crypt32

CryptStringToBinaryA CryptBinaryToStringA

gdi32

CreateDIBSection CreateCompatibleDC StretchBlt DeleteDC CreateCompatibleBitmap SetBkMode SetStretchBltMode DeleteObject CreateSolidBrush SelectObject SetTextColor BitBlt

user32

EndPaint BeginPaint GetCursorPos ReleaseDC IsIconic InvalidateRect GetWindowLongW GetMessageW DefWindowProcW GetSystemMenu PostMessageW GetWindowRect DestroyWindow GetDC SetWindowPos FillRect CreateWindowExW ScreenToClient SendMessageW GetSystemMetrics UnregisterClassW RegisterClassExW TrackPopupMenu ShowWindow GetAsyncKeyState DispatchMessageW SetTimer DrawTextA ClientToScreen MessageBoxA TranslateMessage LoadCursorW DrawMenuBar SetCapture SetCursor SetWindowLongW CheckMenuItem GetClientRect AppendMenuW DrawTextW KillTimer PostQuitMessage CreateMenu ReleaseCapture

turbojpeg

tjDestroy tjDecompress2 tjInitDecompress tjDecompressHeader3

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetProcessHeap SetStdHandle GetStringTypeW CreateFileW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc SetEndOfFile ReadFile ReadConsoleW WriteConsoleW WideCharToMultiByte GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx GetFileSizeEx GetFileType LCMapStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle GetModuleFileNameW GetProcAddress TerminateProcess ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetCommandLineW GetCommandLineA GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer Sleep GetTickCount64 GetModuleHandleW FlsFree WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId CloseHandle GetLastError WaitForSingleObjectEx GetExitCodeThread GetLogicalProcessorInformationEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter GetSystemTimePreciseAsFileTime SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue

Name

.text

Size

220KB

Virtual Size

220KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-23_306ce46d74b575366193e073b6775de5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

ws2_32

bcrypt

crypt32

gdi32

user32

turbojpeg

kernel32

generic