2026-05-06_1be97d39c3e08e105f474198c810757b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

General

Target
2026-05-06_1be97d39c3e08e105f474198c810757b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 379KB
Sample260506-llk2psew8t
SHA256 e37dcf95c655002bc81798486faf912d7b35d4cc249564f64e74be046cab1d0c
MD5 1be97d39c3e08e105f474198c810757b
SHA1 9bcd6bb4e059335b59c5d219b19b251ebc6f044b
SHA512 bc20834e4d4985ebcc49eb7b50fad2b8f6e7a6e648db246b5d58a1f363f9d05182bed5169628ebf3526b7fdfe7221fbf1b0da70798878be500361bf4a9a06e30
SSDEEP 6144:wWG7gj6HS/oHJ0XE4VilVR3BbfN7o4qKQZt2My65MJWbQrgTXGnN:u/NN6vZtHGJPrgTWN
TLSH
T182846C35E66431F9D13BCD34A9124D02EA61BC7603E099CB1BE449971EE6DE0DE3EB90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-06_1be97d39c3e08e105f474198c810757b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-05-06_1be97d39c3e08e105f474198c810757b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 379KB

2026-05-06_1be97d39c3e08e105f474198c810757b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 6f97e5f5ef056c2135b3a34600bddddb
SHA256 e37dcf95c655002bc81798486faf912d7b35d4cc249564f64e74be046cab1d0c
MD5 1be97d39c3e08e105f474198c810757b
SHA1 9bcd6bb4e059335b59c5d219b19b251ebc6f044b
SHA512 bc20834e4d4985ebcc49eb7b50fad2b8f6e7a6e648db246b5d58a1f363f9d05182bed5169628ebf3526b7fdfe7221fbf1b0da70798878be500361bf4a9a06e30
SSDEEP 6144:wWG7gj6HS/oHJ0XE4VilVR3BbfN7o4qKQZt2My65MJWbQrgTXGnN:u/NN6vZtHGJPrgTWN
TLSH
T182846C35E66431F9D13BCD34A9124D02EA61BC7603E099CB1BE449971EE6DE0DE3EB90
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

160352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Process32FirstW HeapAlloc GlobalLock GetComputerNameW GetProcessHeap GlobalSize WriteConsoleW HeapSize CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW Process32NextW GetLastError Sleep CreateToolhelp32Snapshot GlobalUnlock GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale FindClose FindFirstFileExW FindNextFileW CloseHandle GetModuleHandleW GetProcAddress MultiByteToWideChar WideCharToMultiByte LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetFilePointerEx GetFileType HeapFree FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapReAlloc VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW

user32

EmptyClipboard CloseClipboard OpenClipboard GetClipboardData SetClipboardData

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCloseKey

wininet

HttpOpenRequestW InternetOpenW InternetCrackUrlW HttpSendRequestW InternetCloseHandle InternetReadFile InternetConnectW HttpAddRequestHeadersW

Name

.text

Size

278KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

4KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-06_1be97d39c3e08e105f474198c810757b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

kernel32

user32

advapi32

wininet

generic