2026-06-01_52077ad9e22407c41713cb2c03d0d16d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-01_52077ad9e22407c41713cb2c03d0d16d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 273KB
Sample260601-hj3beses21
SHA256 30513403514b88a0402a8894152b1758b4e74cb79d4be28cca8cceddabe0ef4b
MD5 52077ad9e22407c41713cb2c03d0d16d
SHA1 e2e42dde08973c990d9bfe98c1595eb9a33160bd
SHA512 54e9a88dc83ea1223a805dc786c902b5ce04dadc8f98425aded886cf701c089f71a39152a40a059be9551bb731194d9986b7373288e9ed0f1b99b831f49b6959
SSDEEP 6144:FiVEZjUI8oAzOndS2Plat4F9X3zyU25Y0:tZjUI8oAj2PDz6
TLSH
T1B2546D19B2A418FCE8B7C17DCA965943E771BC460330DAEF07A056562F276E48E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-01_52077ad9e22407c41713cb2c03d0d16d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-06-01_52077ad9e22407c41713cb2c03d0d16d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 273KB

2026-06-01_52077ad9e22407c41713cb2c03d0d16d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH e9c3a32a60335681bb6783748a3dba1f
SHA256 30513403514b88a0402a8894152b1758b4e74cb79d4be28cca8cceddabe0ef4b
MD5 52077ad9e22407c41713cb2c03d0d16d
SHA1 e2e42dde08973c990d9bfe98c1595eb9a33160bd
SHA512 54e9a88dc83ea1223a805dc786c902b5ce04dadc8f98425aded886cf701c089f71a39152a40a059be9551bb731194d9986b7373288e9ed0f1b99b831f49b6959
SSDEEP 6144:FiVEZjUI8oAzOndS2Plat4F9X3zyU25Y0:tZjUI8oAj2PDz6
TLSH
T1B2546D19B2A418FCE8B7C17DCA965943E771BC460330DAEF07A056562F276E48E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

gethostname WSAStartup inet_ntoa gethostbyname WSACleanup

winhttp

WinHttpReceiveResponse WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpQueryDataAvailable WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpen

gdiplus

GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdiplusShutdown GdiplusStartup GdipDisposeImage GdipFree GdipSaveImageToStream

ole32

CLSIDFromString CreateStreamOnHGlobal

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateDCW GetDeviceCaps DeleteDC DeleteObject BitBlt

advapi32

GetUserNameW GetTokenInformation OpenProcessToken

user32

GetDC GetSystemMetrics wsprintfA ReleaseDC

kernel32

SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP GetStringTypeW FindNextFileW FindFirstFileExW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc CreateFileW WriteConsoleW IsValidCodePage GetTickCount LCMapStringW CompareStringW ReadFile FindFirstFileA VirtualProtect HeapFree GetCurrentProcess WriteFile VirtualAlloc GetDriveTypeA FindNextFileA CreatePipe SetFilePointer FindClose WaitForSingleObject GetModuleHandleA MultiByteToWideChar Sleep GetLastError CreateFileA FileTimeToSystemTime lstrcpyA CloseHandle FreeConsole HeapAlloc GetLogicalDriveStringsA GetProcAddress GetFileSize ExitProcess GetComputerNameW GetCurrentProcessId GetProcessHeap WideCharToMultiByte CreateProcessA ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW LoadLibraryExW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle GetModuleFileNameW TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter

Name

.text

Size

197KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-01_52077ad9e22407c41713cb2c03d0d16d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

ws2_32

winhttp

gdiplus

ole32

gdi32

advapi32

user32

kernel32

generic