2026-06-28_f02877df0c09c9aef28f80e0b0267d82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-28_f02877df0c09c9aef28f80e0b0267d82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 522KB
Sample260628-wnlfcsbs9k
SHA256 aa08438f9a384cb6d4ff877bd58880d96fc924835409c897b6fc4beabe715388
MD5 f02877df0c09c9aef28f80e0b0267d82
SHA1 514a3fc1adbb92907a4e1f704d0a1dfee64f44bb
SHA512 1f9eb71bc1ae87ec567a0cdb699256d2e35d26a5a93928cbc88c83cbd48b8f1c5fc59a90efdbaeb1b40c3091a3e973b164f221dd4099c58d421ce40cab57e12c
SSDEEP 6144:mmAD+BVW44lckgu4SmFSBH+BSvAUXXiK9Z61nzAWwj3Zqzpcmd9Z33f/B:mzZvguI8lvAsXiK7Jj3ZQOOZB
TLSH
T1F7B47C5AA67807EDD1ABD178CA534407EB75BC86037196DF03A129B60E27AD19F3F320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-28_f02877df0c09c9aef28f80e0b0267d82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-06-28_f02877df0c09c9aef28f80e0b0267d82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 522KB

2026-06-28_f02877df0c09c9aef28f80e0b0267d82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 66a9054977f0fb1c8e71d2a3528249f9
SHA256 aa08438f9a384cb6d4ff877bd58880d96fc924835409c897b6fc4beabe715388
MD5 f02877df0c09c9aef28f80e0b0267d82
SHA1 514a3fc1adbb92907a4e1f704d0a1dfee64f44bb
SHA512 1f9eb71bc1ae87ec567a0cdb699256d2e35d26a5a93928cbc88c83cbd48b8f1c5fc59a90efdbaeb1b40c3091a3e973b164f221dd4099c58d421ce40cab57e12c
SSDEEP 6144:mmAD+BVW44lckgu4SmFSBH+BSvAUXXiK9Z61nzAWwj3Zqzpcmd9Z33f/B:mzZvguI8lvAsXiK7Jj3ZQOOZB
TLSH
T1F7B47C5AA67807EDD1ABD178CA534407EB75BC86037196DF03A129B60E27AD19F3F320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

88480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetPriorityClass EnterCriticalSection GetStdHandle GetCPInfo RemoveDirectoryW GetProcessAffinityMask SetFileTime WaitForMultipleObjects LeaveCriticalSection InitializeCriticalSection SetFilePointer GetEnvironmentVariableW PeekNamedPipe GetTempPathW CreateMutexA LocalAlloc GetTimeFormatA GetCurrentThreadId lstrcmpA ReleaseMutex GetCurrentDirectoryA lstrcatA ExitThread HeapSize SetCurrentDirectoryA GetCommandLineA CreateEventW GetExitCodeThread FormatMessageW K32GetModuleFileNameExA GetLastError SetEvent GetDiskFreeSpaceExW GetCurrentThread GetSystemDirectoryA QueryPerformanceFrequency GetDateFormatA GlobalAlloc DeleteFileW Process32Next lstrcpyA GlobalFree HeapReAlloc GetSystemInfo LoadLibraryW ResetEvent GetWindowsDirectoryA HeapAlloc SetStdHandle GetLogicalDriveStringsA SetFilePointerEx VirtualAllocEx IsProcessorFeaturePresent DeleteCriticalSection GetComputerNameW GetProcessHeap GetModuleHandleW CopyFileW GetSystemTime FormatMessageA VirtualFreeEx GetTempFileNameA CreateEventA VirtualProtect MoveFileW IsWow64Process GetFileTime OpenThread FlushFileBuffers GetExitCodeProcess SetEndOfFile WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetTimeZoneInformation ReadConsoleW GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW GetFileType UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetModuleFileNameW GetModuleHandleExW ExitProcess FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead Process32First MoveFileA LocalFree CreateFileW CreateDirectoryA CreateProcessA WideCharToMultiByte GetFileSize GetModuleFileNameA GetFileAttributesA CreateToolhelp32Snapshot GetEnvironmentVariableA ExpandEnvironmentStringsA CreatePipe TerminateProcess SetHandleInformation GetLogicalDrives GetFileSizeEx ReadFile VirtualAlloc VirtualFree GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW CompareStringEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx FreeEnvironmentStringsA GetEnvironmentStrings CopyFileA MultiByteToWideChar GetVolumeInformationA GetDriveTypeA GetFileAttributesExA GetComputerNameA GetTickCount QueryPerformanceCounter GetDiskFreeSpaceExA FreeLibrary GlobalMemoryStatusEx GetCurrentProcessId RemoveDirectoryA GetProcAddress GetLocalTime SetFileAttributesA CreateThread GetNativeSystemInfo CloseHandle DeleteFileA GetVersionExA LoadLibraryA CreateFileA GetTickCount64 GetTempPathA Sleep OpenProcess GetModuleHandleA WaitForSingleObject FindClose lstrlenA SetThreadPriority FindNextFileA HeapFree WriteFile GetCurrentProcess FindFirstFileA GetVolumePathNameA RtlUnwind

user32

BeginPaint GetCursorPos SetCursorPos GetDC InvalidateRect UpdateWindow RegisterClassExA GetWindowTextLengthA CharLowerA GetDesktopWindow KillTimer GetClientRect EndPaint ReleaseDC GetLastInputInfo GetWindowTextA ClientToScreen GetSystemMetrics IsIconic SetTimer GetAsyncKeyState GetClassInfoExA CharUpperA LoadIconA wsprintfW SendMessageA TranslateMessage BringWindowToTop CreateWindowExA DefWindowProcA GetForegroundWindow ShowWindow GetActiveWindow wsprintfA ScreenToClient SetWindowTextA PostMessageA MessageBoxW IsWindowVisible LoadCursorA GetWindowRect DispatchMessageA GetMessageA GetKeyState MessageBoxA

gdi32

SelectObject MoveToEx CreateCompatibleDC DeleteDC CreateCompatibleBitmap CreateFontA GetTextExtentPoint32A SetPixel GetStockObject GetDeviceCaps GetPixel SetTextColor TextOutA SetBkMode LineTo CreatePen Rectangle CreateFontIndirectA Ellipse CreateSolidBrush GetObjectA BitBlt DeleteObject

winhttp

WinHttpWriteData WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest

advapi32

RegCloseKey GetTokenInformation RegOpenKeyExA OpenProcessToken GetUserNameA RegEnumKeyExA RegQueryValueExA CryptDestroyKey AdjustTokenPrivileges CryptAcquireContextA RegDeleteKeyA CryptEncrypt CryptGenRandom LookupPrivilegeValueA RegCreateKeyExA CryptDecrypt RegCreateKeyExW CryptCreateHash CryptDeriveKey CryptHashData RegSetValueExW RegSetValueExA CryptDestroyHash RegOpenKeyExW RegEnumValueA RegDeleteValueA GetUserNameW RegQueryValueExW CryptReleaseContext

shell32

ShellExecuteW ShellExecuteA SHGetFileInfoA SHGetFolderPathA

ole32

CoCreateInstance CoUninitialize CLSIDFromString ProgIDFromCLSID CoTaskMemFree StringFromGUID2 CoTaskMemAlloc CoInitialize CoInitializeEx

shlwapi

PathCombineA PathFindFileNameA PathFileExistsA PathAddBackslashA PathRemoveFileSpecA

gdiplus

GdipSaveImageToFile GdipFree GdipDisposeImage GdiplusStartup GdiplusShutdown GdipCloneImage GdipAlloc GdipCreateBitmapFromHBITMAP

iphlpapi

GetNetworkParams GetAdaptersInfo GetIfTable GetIpForwardTable

winmm

timeGetTime

crypt32

CertCloseStore CryptUnprotectData CertEnumCertificatesInStore CertOpenSystemStoreA

bcrypt

BCryptDecrypt BCryptGenRandom BCryptEncrypt BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyKey

ws2_32

bind closesocket gethostbyname listen getpeername getsockname send socket accept connect gethostname recv htonl htons ioctlsocket setsockopt select ntohl WSACleanup ntohs WSAStartup getsockopt

Name

.text

Size

378KB

Virtual Size

377KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

115KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_f02877df0c09c9aef28f80e0b0267d82_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

kernel32

user32

gdi32

winhttp

advapi32

shell32

ole32

shlwapi

gdiplus

iphlpapi

winmm

crypt32

bcrypt

ws2_32

generic