2026-04-24_8cf5a5ddf4ab390db7433ee3123beb5a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-24_8cf5a5ddf4ab390db7433ee3123beb5a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 941KB
Sample260424-he8yeahx5t
SHA256 68a0e0f05bf1c8e0b56accf55c862a7c8599768df178502b97ef1b536ed2fee7
MD5 8cf5a5ddf4ab390db7433ee3123beb5a
SHA1 47ce3852497768eb984bfdb4db9e42d691e8f131
SHA512 b54af0a0e8d30dece62229c20927fdf9c2e9afdeaeb6141533f939fd80f863fb3cb61367c35160d815ec57e57b33380117d53f737f3c73e0bde80a43f5c4243e
SSDEEP 24576:DSt4+lxMzoKipvgfc7oUYxAILp8aS9BIi2n2P0Ti9UW0u:Gt4bkgeYxAy2Tt2nS04
TLSH
T15B25BF49F6F801E8E07BA234C9B1661BEA367855173096CF17E4065D2F736E04BBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-24_8cf5a5ddf4ab390db7433ee3123beb5a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-04-24_8cf5a5ddf4ab390db7433ee3123beb5a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 941KB

2026-04-24_8cf5a5ddf4ab390db7433ee3123beb5a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 976f54d32e3eb60c7441842e5ff8a89f
SHA256 68a0e0f05bf1c8e0b56accf55c862a7c8599768df178502b97ef1b536ed2fee7
MD5 8cf5a5ddf4ab390db7433ee3123beb5a
SHA1 47ce3852497768eb984bfdb4db9e42d691e8f131
SHA512 b54af0a0e8d30dece62229c20927fdf9c2e9afdeaeb6141533f939fd80f863fb3cb61367c35160d815ec57e57b33380117d53f737f3c73e0bde80a43f5c4243e
SSDEEP 24576:DSt4+lxMzoKipvgfc7oUYxAILp8aS9BIi2n2P0Ti9UW0u:Gt4bkgeYxAy2Tt2nS04
TLSH
T15B25BF49F6F801E8E07BA234C9B1661BEA367855173096CF17E4065D2F736E04BBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

402416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpOpen

bcrypt

BCryptCreateHash BCryptDestroyKey BCryptDecrypt BCryptFinishHash BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider BCryptHashData BCryptDestroyHash BCryptGenRandom BCryptGenerateSymmetricKey

advapi32

AllocateAndInitializeSid CheckTokenMembership FreeSid RegCloseKey RegOpenKeyExA RegQueryValueExA CloseServiceHandle OpenSCManagerA OpenServiceA QueryServiceStatus

crypt32

CryptStringToBinaryA

shell32

SHGetFolderPathA ShellExecuteW ShellExecuteA

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

user32

TranslateMessage ScreenToClient ClientToScreen SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadIconW LoadCursorW FindWindowA GetCursorPos MessageBoxA GetWindowRect UpdateWindow GetSystemMetrics ReleaseCapture SetCapture SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW

gdi32

CreateSolidBrush

kernel32

OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW LCMapStringW GetEnvironmentStringsW FreeEnvironmentStringsW LoadLibraryExW VirtualProtect SetFilePointerEx GetFileSizeEx GetConsoleOutputCP ReadConsoleW GetConsoleMode HeapAlloc HeapFree UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader GetProcessHeap SetStdHandle GetStringTypeW CreateFileW HeapSize CreateDirectoryA CreateFileA DeleteFileA FlushFileBuffers ReadFile RemoveDirectoryA SetFileAttributesA WriteFile GetTempPathA GetVolumeInformationA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle SetHandleInformation GetLastError CreatePipe QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess ExitProcess TerminateProcess GetExitCodeProcess CreateProcessA GetTickCount GetWindowsDirectoryA GetModuleHandleA GetModuleHandleW GetProcAddress GetFirmwareEnvironmentVariableA MoveFileExA MultiByteToWideChar OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree WideCharToMultiByte FreeLibrary LoadLibraryA GetLocaleInfoA IsDBCSLeadByte WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetSystemTimePreciseAsFileTime WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead HeapReAlloc SetEndOfFile GetModuleFileNameA

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

Name

.text

Size

549KB

Virtual Size

548KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

200KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

157KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-24_8cf5a5ddf4ab390db7433ee3123beb5a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

winhttp

bcrypt

advapi32

crypt32

shell32

d3d11

d3dcompiler_47

user32

gdi32

kernel32

imm32

generic