2026-06-28_3ed7cedf4e82c464afdcc3e97806fac9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-28_3ed7cedf4e82c464afdcc3e97806fac9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 24.0MB
Sample260628-25csfaf15v
SHA256 9b02d8ac669d0e0243055420ab435dc63339b3ca9ece87536034206596d273d4
MD5 3ed7cedf4e82c464afdcc3e97806fac9
SHA1 52cd487198998c2a72e34cbdc31fe095de03c5fc
SHA512 cba9b06f1205c446cd92c82d1fc8709e89bfe7ccbce318cc00c8199906b3933ddef0fc182b3dbda361f0e49b6f26f8cad8ce01cca5d69a971bde13dca4c70c53
SSDEEP 49152:cZqcf+bzMUhfXTJlUqVuJqx/FGdfUfWTJUZqQGDSp6jr0S4:DNfXTL4azn
TLSH
T147479E1AB2B501FCC0A7C1798A575D13EAB2740A03769BEF16E089652F23BE05F7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Custom signature

Detects binaries and memory artifacts referencing sandbox product IDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxProductID

Custom signature

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_3ed7cedf4e82c464afdcc3e97806fac9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-06-28_3ed7cedf4e82c464afdcc3e97806fac9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 24.0MB

2026-06-28_3ed7cedf4e82c464afdcc3e97806fac9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH c66cc2e6c5b62b77f7a13b99fa56f197
SHA256 9b02d8ac669d0e0243055420ab435dc63339b3ca9ece87536034206596d273d4
MD5 3ed7cedf4e82c464afdcc3e97806fac9
SHA1 52cd487198998c2a72e34cbdc31fe095de03c5fc
SHA512 cba9b06f1205c446cd92c82d1fc8709e89bfe7ccbce318cc00c8199906b3933ddef0fc182b3dbda361f0e49b6f26f8cad8ce01cca5d69a971bde13dca4c70c53
SSDEEP 49152:cZqcf+bzMUhfXTJlUqVuJqx/FGdfUfWTJUZqQGDSp6jr0S4:DNfXTL4azn
TLSH
T147479E1AB2B501FCC0A7C1798A575D13EAB2740A03769BEF16E089652F23BE05F7E711
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects binaries and memory artifacts referencing sandbox product IDs
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1895496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpAddRequestHeaders WinHttpOpen WinHttpCloseHandle WinHttpWebSocketCompleteUpgrade WinHttpWebSocketClose WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpSetOption WinHttpQueryHeaders WinHttpCrackUrl WinHttpReceiveResponse WinHttpReadData WinHttpOpenRequest WinHttpQueryDataAvailable

crypt32

CryptBinaryToStringA CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptFinishHash BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptEncrypt BCryptCloseAlgorithmProvider BCryptSetProperty

wtsapi32

WTSQuerySessionInformationW WTSQueryUserToken WTSEnumerateSessionsW WTSFreeMemory

shell32

ShellExecuteW CommandLineToArgvW

shlwapi

PathFileExistsW PathFindFileNameW

ole32

CoTaskMemFree CreateStreamOnHGlobal

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

ntdll

RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader RtlInitUnicodeString RtlCaptureContext RtlVirtualUnwind RtlUnwind

gdiplus

GdipCreateBitmapFromScan0 GdiplusStartup GdiplusShutdown GdipGetImageEncoders GdipCloneImage GdipDeleteGraphics GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipAlloc GdipSetInterpolationMode GdipGetImageGraphicsContext GdipSetPixelOffsetMode GdipSetCompositingQuality GdipDrawImageRectI

kernel32

VirtualProtect UnhandledExceptionFilter IsDebuggerPresent GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID Sleep GetLastError ExitProcess MultiByteToWideChar SetThreadAffinityMask GetSystemFirmwareTable GetPhysicallyInstalledSystemMemory TerminateProcess LocalAlloc GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Process32NextW QueryPerformanceFrequency Process32FirstW CloseHandle GetNativeSystemInfo LocalFree GetModuleHandleW WideCharToMultiByte SleepEx BuildCommDCBAndTimeoutsA EnumSystemFirmwareTables QueryPerformanceCounter VirtualQuery GetComputerNameA SizeofResource GetModuleFileNameW EnumResourceNamesW SetFileAttributesW GetLogicalDriveStringsW EndUpdateResourceW LockResource LoadResource FindResourceW UpdateResourceW FreeLibrary BeginUpdateResourceW QueryFullProcessImageNameW GetDriveTypeW LoadLibraryExW ReadFile FindFirstFileW GetFileSizeEx WriteProcessMemory GetFullPathNameW FindNextFileW GetCurrentProcess WriteFile WaitForDebugEvent GetFinalPathNameByHandleW EnumSystemLocalesW SetFilePointer FindClose WaitForSingleObject CreateFileW GetFileAttributesW DebugActiveProcessStop SuspendThread ResumeThread ContinueDebugEvent DuplicateHandle K32EnumProcessModulesEx GetTickCount64 VirtualProtectEx GetThreadContext GetProcAddress WTSGetActiveConsoleSessionId ReadProcessMemory GetCurrentProcessId CreateProcessW GetFileType K32GetMappedFileNameW SetThreadContext OpenThread VirtualQueryEx DebugSetProcessKillOnExit GetVolumeInformationW DeleteFileW MoveFileExW GetComputerNameW GlobalMemoryStatusEx GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetFileAttributesExW GetTickCount GetCurrentThreadId GetTempPathW GetCommandLineW CreateMutexW ExitThread CreateEventW SetUnhandledExceptionFilter GetVersionExW GetTimeZoneInformation GetSystemInfo CreateDirectoryW QueryDosDeviceW ExpandEnvironmentStringsW GetEnvironmentVariableW CreateThread GetLocalTime CopyFileW GetExitCodeProcess LoadLibraryW SetDllDirectoryW GetLogicalDrives GetDriveTypeA CreatePipe SetErrorMode OpenEventW SetEvent FileTimeToSystemTime SetFilePointerEx GetDiskFreeSpaceExA AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetConsoleOutputCP OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA HeapReAlloc RaiseException HeapAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx GetFileSize DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile FlushFileBuffers GetConsoleMode ReadConsoleW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW K32GetModuleFileNameExW GetFileAttributesA

user32

CloseClipboard OpenClipboard SendInput GetMonitorInfoW ReleaseDC QueryDisplayConfig EmptyClipboard GetClipboardData SetClipboardData GetSystemMetrics EnumDisplayDevicesW CharUpperW GetDC EnumDisplayMonitors

gdi32

SelectObject CreateCompatibleBitmap DeleteObject BitBlt CreateCompatibleDC DeleteDC GetDeviceCaps

advapi32

RegCloseKey RegQueryValueExA LookupPrivilegeValueW EqualSid AllocateAndInitializeSid RegCreateKeyExW CreateProcessWithTokenW RegDeleteTreeW RegSetValueExW FreeSid CryptAcquireContextA RevertToSelf SetTokenInformation ImpersonateLoggedOnUser DuplicateTokenEx SetSecurityDescriptorDacl InitializeSecurityDescriptor CreateProcessAsUserW LookupPrivilegeValueA RegQueryValueExW GetUserNameW RegOpenKeyExW AdjustTokenPrivileges RegGetValueW GetTokenInformation CryptAcquireContextW OpenProcessToken RegEnumKeyExW CryptReleaseContext CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceRegistryPropertyA SetupDiOpenDevRegKey SetupDiEnumDeviceInfo SetupDiGetDevicePropertyW

api-ms-win-core-realtime-l1-1-1

QueryInterruptTime

iphlpapi

GetAdaptersInfo

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW GetExitCodeThread

api-ms-win-core-sysinfo-l1-1-0

GetLogicalProcessorInformationEx

api-ms-win-core-file-l1-1-0

SetFileInformationByHandle FindFirstFileExW

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-localization-l1-2-0

GetCPInfo LCMapStringEx GetLocaleInfoEx

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable InitOnceBeginInitialize InitOnceComplete WakeConditionVariable SleepConditionVariableSRW

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-string-l1-1-0

GetStringTypeW CompareStringEx

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

wevtapi

EvtNext EvtRender EvtClose EvtCreateRenderContext EvtQuery

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

mf

MFEnumDeviceSources

mfplat

MFCreateMediaType MFStartup MFCreateAttributes MFShutdown

mfreadwrite

MFCreateSourceReaderFromMediaSource

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_3ed7cedf4e82c464afdcc3e97806fac9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

winhttp

crypt32

bcrypt

wtsapi32

shell32

shlwapi

ole32

userenv

ntdll

gdiplus

kernel32

user32

gdi32

advapi32

setupapi

api-ms-win-core-realtime-l1-1-1

iphlpapi

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-interlocked-l1-1-0

wevtapi

d3d11

dxgi

mf

mfplat

mfreadwrite

generic