2026-05-18_0e7d0caeb94f97890e0bcf5479d3f1d0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-18_0e7d0caeb94f97890e0bcf5479d3f1d0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 29.1MB
Sample260518-ej63tsbv5n
SHA256 b2c87f3bfbbde493a28312507c5dcd9c099511cf8ed54d4cee0db6604cbdc16e
MD5 0e7d0caeb94f97890e0bcf5479d3f1d0
SHA1 e5e2cef2960c37c067c999217c75efdf2fc25ed8
SHA512 5bc2a338e150116b5515e3db1a4e2dcbb2baae6d1fb569f90573bdc3df4418706246f528c696f38cb7f4e5f21bbffa5e7b9452f8ee3d61e58b1ca599235547d4
SSDEEP 49152:CI+d60rPd5R4+ZvA+XjfXr9Hg0gJ7Bca0DSV7oUQBVsFxyFSU:GbZTXj/JA6B0y
TLSH
T1B3679E1BB2A501FCD0A7D179CA174D13EAB2780903769BEF16E089652F23AE15F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects binaries and memory artifacts referencing sandbox product IDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxProductID

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-18_0e7d0caeb94f97890e0bcf5479d3f1d0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-05-18_0e7d0caeb94f97890e0bcf5479d3f1d0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 29.1MB

2026-05-18_0e7d0caeb94f97890e0bcf5479d3f1d0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 73086d81524d8bf24f6ae44e038e47d1
SHA256 b2c87f3bfbbde493a28312507c5dcd9c099511cf8ed54d4cee0db6604cbdc16e
MD5 0e7d0caeb94f97890e0bcf5479d3f1d0
SHA1 e5e2cef2960c37c067c999217c75efdf2fc25ed8
SHA512 5bc2a338e150116b5515e3db1a4e2dcbb2baae6d1fb569f90573bdc3df4418706246f528c696f38cb7f4e5f21bbffa5e7b9452f8ee3d61e58b1ca599235547d4
SSDEEP 49152:CI+d60rPd5R4+ZvA+XjfXr9Hg0gJ7Bca0DSV7oUQBVsFxyFSU:GbZTXj/JA6B0y
TLSH
T1B3679E1BB2A501FCD0A7D179CA174D13EAB2780903769BEF16E089652F23AE15F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects binaries and memory artifacts referencing sandbox product IDs
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1881016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpSetTimeouts WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpWebSocketCompleteUpgrade WinHttpWebSocketClose WinHttpCrackUrl WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpQueryDataAvailable WinHttpSendRequest WinHttpSetOption

crypt32

CryptBinaryToStringA CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptDecrypt BCryptFinishHash

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

shell32

CommandLineToArgvW ShellExecuteW ShellExecuteA

shlwapi

PathFileExistsW PathFindFileNameW

ole32

CoTaskMemFree CreateStreamOnHGlobal

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

ntdll

RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlInitUnicodeString RtlUnwind

gdiplus

GdipDeleteGraphics GdipCreateBitmapFromScan0 GdiplusStartup GdiplusShutdown GdipGetImageEncoders GdipCloneImage GdipGetImageGraphicsContext GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipAlloc GdipDrawImageRectI GdipSetPixelOffsetMode GdipSetInterpolationMode GdipSetCompositingQuality

kernel32

VirtualProtect UnhandledExceptionFilter IsDebuggerPresent GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError CompareStringW LCMapStringW GetLocaleInfoW Sleep GetLastError ExitProcess MultiByteToWideChar SetThreadAffinityMask GetSystemFirmwareTable GetPhysicallyInstalledSystemMemory TerminateProcess LocalAlloc GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Process32NextW QueryPerformanceFrequency Process32FirstW CloseHandle GetNativeSystemInfo LocalFree GetModuleHandleW WideCharToMultiByte SleepEx BuildCommDCBAndTimeoutsA EnumSystemFirmwareTables QueryPerformanceCounter VirtualQuery GetComputerNameA SizeofResource GetModuleFileNameW EnumResourceNamesW SetFileAttributesW GetLogicalDriveStringsW EndUpdateResourceW LockResource LoadResource FindResourceW UpdateResourceW FreeLibrary BeginUpdateResourceW QueryFullProcessImageNameW GetDriveTypeW LoadLibraryExW ReadFile GetFileSizeEx WriteProcessMemory FindFirstFileA GetCurrentProcess WriteFile WaitForDebugEvent K32GetModuleFileNameExW FindNextFileA SetFilePointer GetFullPathNameA FindClose WaitForSingleObject DebugActiveProcessStop IsValidLocale ResumeThread ContinueDebugEvent DuplicateHandle K32EnumProcessModulesEx GetFinalPathNameByHandleA GetTickCount64 GetFileAttributesA CreateFileA VirtualProtectEx GetThreadContext GetProcAddress WTSGetActiveConsoleSessionId ReadProcessMemory GetCurrentProcessId CreateProcessW GetFileType K32GetMappedFileNameW SetThreadContext OpenThread VirtualQueryEx DebugSetProcessKillOnExit GetVolumeInformationW FindFirstFileW FindNextFileW CreateFileW DeleteFileW MoveFileExW GetComputerNameW GlobalMemoryStatusEx GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetFileAttributesExW GetTickCount GetCurrentThreadId GetTempPathW GetSystemTime GetCommandLineW CreateMutexA ExitThread CreateEventA SetUnhandledExceptionFilter GetVersionExW GetTimeZoneInformation GetSystemInfo CreateDirectoryW QueryDosDeviceW GetFileAttributesExA ExpandEnvironmentStringsA GetEnvironmentVariableW GetFileAttributesW CreateThread GetLocalTime CopyFileW CreateProcessA GetExitCodeProcess LoadLibraryW SetDllDirectoryW OpenEventA GetLogicalDrives GetDriveTypeA CreatePipe SetErrorMode SetEvent FileTimeToSystemTime SetFilePointerEx GetDiskFreeSpaceExA AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetEndOfFile UnlockFileEx CreateMutexW UnmapViewOfFile GetUserDefaultLCID HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA HeapReAlloc RaiseException HeapAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx GetFileSize DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile FlushFileBuffers EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode ReadConsoleW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW SuspendThread HeapValidate

user32

GetDC OpenClipboard EnumDisplayMonitors GetMonitorInfoW ReleaseDC SendInput QueryDisplayConfig CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetSystemMetrics EnumDisplayDevicesW CharUpperA

gdi32

SelectObject CreateCompatibleBitmap DeleteObject BitBlt DeleteDC CreateCompatibleDC GetDeviceCaps

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExW RegDeleteTreeA EqualSid AllocateAndInitializeSid RegCreateKeyExA CreateProcessWithTokenW RegSetValueExA FreeSid CryptAcquireContextA RevertToSelf SetTokenInformation ImpersonateLoggedOnUser RegOpenKeyExA DuplicateTokenEx RegEnumKeyExA LookupPrivilegeValueW CreateProcessAsUserW LookupPrivilegeValueA RegQueryValueExW GetUserNameW InitializeSecurityDescriptor OpenProcessToken SetSecurityDescriptorDacl RegGetValueW RegEnumKeyExW AdjustTokenPrivileges CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptAcquireContextW GetTokenInformation

setupapi

SetupDiGetDevicePropertyW SetupDiOpenDevRegKey SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW

api-ms-win-core-realtime-l1-1-1

QueryInterruptTime

iphlpapi

GetAdaptersInfo

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive InitializeCriticalSectionEx TryAcquireSRWLockExclusive AcquireSRWLockExclusive

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW GetExitCodeThread

api-ms-win-core-sysinfo-l1-1-0

GetLogicalProcessorInformationEx

api-ms-win-core-file-l1-1-0

SetFileInformationByHandle FindFirstFileExW GetFinalPathNameByHandleW

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx GetCPInfo LCMapStringEx

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete WakeConditionVariable SleepConditionVariableSRW

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-string-l1-1-0

GetStringTypeW CompareStringEx

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

wevtapi

EvtQuery EvtRender EvtClose EvtCreateRenderContext EvtNext

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

mf

MFEnumDeviceSources

mfplat

MFCreateMediaType MFCreateAttributes MFStartup MFShutdown

mfreadwrite

MFCreateSourceReaderFromMediaSource

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-18_0e7d0caeb94f97890e0bcf5479d3f1d0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

winhttp

crypt32

bcrypt

wtsapi32

shell32

shlwapi

ole32

userenv

ntdll

gdiplus

kernel32

user32

gdi32

advapi32

setupapi

api-ms-win-core-realtime-l1-1-1

iphlpapi

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-interlocked-l1-1-0

wevtapi

d3d11

dxgi

mf

mfplat

mfreadwrite

generic