2026-07-04_31938ca5801bc95e72a52382e8a37206_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-04_31938ca5801bc95e72a52382e8a37206_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 2.5MB
Sample260704-c856qaav6z
SHA256 09de379209d77a430df2f72565f1d03a1ef872643acf6ac14aea944909c6fe06
MD5 31938ca5801bc95e72a52382e8a37206
SHA1 8ebaa6dd1591321c0831cbc94732ee1bb11158c7
SHA512 b19a1a606231a6e71520d5e6b440ccdc15867b0902cbff718749b9750fbca561bcd63a201a1c44c2fcee98cd966b3a6a1c7a4e97b15d75c9d9bdf65dac1d9d73
SSDEEP 49152:z8Q8lmUl8P3v+qSgETlzGPkQisxl9yAQg0IjaiQjMYlip1gq+PRESsCYhoRqsy/5:zt8JezSg2zmMsxdQgRaula
TLSH
T1E4C59E4762B800FDC42BD2798A16195BE7B2B4150B799BEF06908A651F33FE25E3D730
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-04_31938ca5801bc95e72a52382e8a37206_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-07-04_31938ca5801bc95e72a52382e8a37206_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 2.5MB

2026-07-04_31938ca5801bc95e72a52382e8a37206_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH f18cd22c13d4ada885f27d5b63fd6f3c
SHA256 09de379209d77a430df2f72565f1d03a1ef872643acf6ac14aea944909c6fe06
MD5 31938ca5801bc95e72a52382e8a37206
SHA1 8ebaa6dd1591321c0831cbc94732ee1bb11158c7
SHA512 b19a1a606231a6e71520d5e6b440ccdc15867b0902cbff718749b9750fbca561bcd63a201a1c44c2fcee98cd966b3a6a1c7a4e97b15d75c9d9bdf65dac1d9d73
SSDEEP 49152:z8Q8lmUl8P3v+qSgETlzGPkQisxl9yAQg0IjaiQjMYlip1gq+PRESsCYhoRqsy/5:zt8JezSg2zmMsxdQgRaula
TLSH
T1E4C59E4762B800FDC42BD2798A16195BE7B2B4150B799BEF06908A651F33FE25E3D730
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1440832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

htonl ntohs inet_addr inet_pton WSASocketW listen gethostbyname bind accept ioctlsocket freeaddrinfo htons sendto getsockopt connect socket WSAStartup WSAIoctl shutdown send recv setsockopt WSACleanup __WSAFDIsSet closesocket select getaddrinfo WSAGetLastError

user32

SetProcessDPIAware OpenDesktopW SwapMouseButton ShowCursor GetWindowTextW PostQuitMessage wsprintfW OpenWindowStationW FindWindowW GetWindowThreadProcessId GetWindowTextLengthW GetSystemMenu RealChildWindowFromPoint CallWindowProcW MapVirtualKeyW FindWindowExW GetLastInputInfo GetWindowRect DestroyWindow GetDC IsWindowVisible SetWindowPos keybd_event SetActiveWindow SetWindowLongPtrW FillRect ScreenToClient SetWindowTextW GetShellWindow RealGetWindowClassW RegisterClassExW WindowFromPoint GetWindowPlacement SetKeyboardState GetThreadDesktop GetKeyboardState wsprintfA IsWindow GetAsyncKeyState ChangeDisplaySettingsW CloseDesktop OpenClipboard CloseClipboard EmptyClipboard GetKeyboardLayout AttachThreadInput CreateDesktopW ToUnicodeEx GetTopWindow MoveWindow EnumWindows SetFocus SendNotifyMessageW BringWindowToTop GetClipboardData EnumDesktopWindows GetClassNameW mouse_event DrawMenuBar SetClipboardData ToUnicode GetUserObjectInformationW PrintWindow RemoveMenu GetClientRect GetDlgItem PostThreadMessageW TranslateMessage EnumDisplaySettingsW MenuItemFromPoint SystemParametersInfoW GetParent PtInRect UpdateWindow ReleaseCapture SetForegroundWindow GetAncestor IsIconic SetCursorPos ChildWindowFromPoint ReleaseDC BeginPaint EndPaint SendInput GetMessageW DefWindowProcW PostMessageW GetWindow SendMessageTimeoutW CloseWindowStation MessageBoxW CreateWindowExW SendMessageW GetSystemMetrics MessageBeep SetThreadDesktop ShowWindow DispatchMessageW ExitWindowsEx RegisterClassW LockWorkStation BlockInput GetForegroundWindow SetProcessWindowStation OpenInputDesktop GetDesktopWindow

gdi32

CreateDIBSection SetStretchBltMode DeleteDC GetDeviceCaps GetStockObject SetBrushOrgEx BitBlt CreateCompatibleBitmap SelectObject DeleteObject CreateCompatibleDC PatBlt StretchBlt CreateFontW

advapi32

SetSecurityDescriptorDacl RegQueryValueExW DuplicateTokenEx GetUserNameW OpenServiceW RegDeleteValueW ChangeServiceConfigW StartServiceCtrlDispatcherW SetSecurityInfo CreateProcessAsUserW RegOpenKeyExW InitializeSecurityDescriptor CheckTokenMembership FreeSid RegQueryValueExA RegOpenKeyExA RegDeleteKeyExW RegQueryInfoKeyW CredEnumerateW GetSidSubAuthorityCount GetSidSubAuthority SetEntriesInAclW CredFree ControlService RegEnumKeyExW StartServiceW EnumServicesStatusExW QueryServiceConfigW LookupAccountSidW RegEnumValueW LookupPrivilegeValueW RegisterServiceCtrlHandlerExW GetTokenInformation AdjustTokenPrivileges RevertToSelf CreateServiceW RegCloseKey EqualSid CloseServiceHandle OpenSCManagerW RegDeleteKeyW AllocateAndInitializeSid SetServiceStatus ChangeServiceConfig2W RegCreateKeyExW DeleteService ImpersonateLoggedOnUser RegDeleteTreeW RegSetValueExW OpenProcessToken

shell32

SHGetFolderPathW SHCreateDirectoryExW ShellExecuteExW ShellExecuteW SHAppBarMessage SHChangeNotify

ole32

CoInitializeEx CoUninitialize CreateStreamOnHGlobal CoTaskMemFree CoCreateInstance GetHGlobalFromStream CoSetProxyBlanket

oleaut32

VariantInit SysAllocString VariantClear SysFreeString

gdiplus

GdipSaveImageToStream GdipGetImageEncodersSize GdipCreateBitmapFromScan0 GdipCloneImage GdiplusStartup GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipImageRotateFlip GdipGetImageEncoders GdipFree

wininet

InternetReadFile InternetOpenW InternetSetOptionW InternetOpenUrlW InternetCloseHandle

iphlpapi

GetAdaptersInfo GetExtendedUdpTable GetExtendedTcpTable

crypt32

CertFreeCertificateContext CryptHashCertificate CertDeleteCertificateFromStore CryptDecodeObjectEx CertAddCertificateContextToStore CryptQueryObject CertDuplicateCertificateContext CertCloseStore CertOpenStore CertCompareCertificateName CryptUnprotectData CertFindExtension CertEnumCertificatesInStore

bcrypt

BCryptDecrypt BCryptOpenAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptGenRandom BCryptDestroyKey BCryptCloseAlgorithmProvider

ntdll

RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RtlCaptureContext RtlAddFunctionTable RtlVirtualUnwind

wtsapi32

WTSQueryUserToken WTSDisconnectSession WTSLogoffSession WTSEnumerateSessionsW WTSFreeMemory

winmm

mciSendStringW waveInAddBuffer waveInStart waveInOpen waveInGetDevCapsW waveInUnprepareHeader waveInReset waveInGetNumDevs waveInPrepareHeader waveInClose

kernel32

GetDiskFreeSpaceExW FileTimeToSystemTime GlobalSize K32GetProcessMemoryInfo GetFileAttributesExW GetTimeZoneInformation CancelSynchronousIo GetLogicalDriveStringsW IsProcessInJob PeekNamedPipe SetFilePointer GetProcessId GetSystemTimes DeviceIoControl OutputDebugStringA ExpandEnvironmentStringsW GetFullPathNameW WriteProcessMemory CreateDirectoryW GetExitCodeProcess SetUnhandledExceptionFilter VirtualQuery GetTickCount OpenMutexW K32EnumProcessModules GetTempFileNameW QueryFullProcessImageNameW WideCharToMultiByte FlushInstructionCache CopyFileW FreeLibrary GetModuleHandleW CreateProcessW GlobalMemoryStatusEx SystemTimeToFileTime GetCurrentProcessId SetEnvironmentVariableA ExitProcess DeleteCriticalSection WTSGetActiveConsoleSessionId MoveFileExW GetProcAddress GetWindowsDirectoryW FindResourceW LoadResource lstrcmpiW CreateThread LoadLibraryW GetSystemInfo GetNativeSystemInfo CloseHandle Process32FirstW QueryPerformanceFrequency GlobalAlloc K32GetModuleInformation GetLocalTime VirtualProtectEx GetPriorityClass GlobalLock SetFilePointerEx VirtualAllocEx LocalFree GetThreadId GetFileSize ReadProcessMemory GetComputerNameW SetConsoleCP QueryPerformanceCounter GlobalUnlock MulDiv CreateRemoteThread GetDriveTypeW FindFirstFileA FindNextFileA Module32FirstW Module32NextW AreFileApisANSI HeapCreate HeapFree GetDiskFreeSpaceW LockFile GetFullPathNameA SetEndOfFile UnlockFileEx GetVersionExW UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx GetVersionExA DeleteFileA HeapReAlloc RaiseException HeapAlloc HeapCompact HeapDestroy UnlockFile CreateFileMappingA LockFileEx GetProcessHeap GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile FlushFileBuffers InitializeCriticalSectionEx EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc DeleteFileW LockResource LoadLibraryA TerminateThread GetCurrentThread SetEvent Process32NextW WriteConsoleW ReadConsoleW GetConsoleMode GetConsoleOutputCP GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetLastError GetTickCount64 GetModuleHandleExA GetFileInformationByHandle Sleep GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW ProcessIdToSessionId MultiByteToWideChar CreateEventW CreateToolhelp32Snapshot SetFileAttributesW QueueUserWorkItem SetConsoleOutputCP GetSystemTimeAsFileTime MoveFileW VirtualFreeEx InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetSystemTimePreciseAsFileTime WakeAllConditionVariable SleepConditionVariableSRW InitializeSListHead GetStartupInfoW ResetEvent CompareStringW LoadLibraryExW GetFileType UnhandledExceptionFilter IsDebuggerPresent GetModuleHandleExW GetStdHandle OpenProcess GetModuleHandleA DuplicateHandle GetSystemDirectoryW SuspendThread IsProcessorFeaturePresent ReleaseMutex OpenEventW GetCurrentThreadId GetFileAttributesW CreateFileW WaitForSingleObject FindClose GetEnvironmentVariableA TrySubmitThreadpoolCallback CreateMutexW GetTempPathW ReadFile GetModuleFileNameA SizeofResource FindFirstFileW GetFileSizeEx SetHandleInformation VirtualProtect SetLastError EnterCriticalSection VirtualFree GetCommandLineW FindNextFileW GetCurrentProcess WriteFile VirtualAlloc TerminateProcess RemoveDirectoryW SetFileTime GetModuleFileNameW WaitForMultipleObjects SetEnvironmentVariableW K32GetModuleFileNameExW LeaveCriticalSection CreatePipe InitializeCriticalSection SetErrorMode GetEnvironmentVariableW

secur32

DecryptMessage FreeCredentialsHandle QueryContextAttributesW DeleteSecurityContext AcquireCredentialsHandleA InitializeSecurityContextW EncryptMessage FreeContextBuffer

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

urlmon

URLDownloadToFileW

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

670KB

Virtual Size

670KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cfg

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

251KB

Virtual Size

251KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-04_31938ca5801bc95e72a52382e8a37206_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

ws2_32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

wininet

iphlpapi

crypt32

bcrypt

ntdll

wtsapi32

winmm

kernel32

secur32

userenv

urlmon

generic