2026-07-05_83fee34fffeee580961deb4c0628942a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_83fee34fffeee580961deb4c0628942a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 8.0MB
Sample260705-bthlfaby3j
SHA256 6b7ba3b7b40a24b5052e05a3e2e4b761a2dcc7aa501cd70732f343a407455c1c
MD5 83fee34fffeee580961deb4c0628942a
SHA1 38fd7835ed29b66460e46bbba9bd914c7a0c7f05
SHA512 a45bbd5b6f027f7d99b9c2a9e86ff9bdd91a7f3f74c015893935f9ae86a668b5eb248df54fdbfbebc7371d8fd7bc9f2667acff5756b67e6d93ab9ea9ab9e50ef
SSDEEP 196608:QzrlmQRS4bABcTr7SfHXLhpsPCKZy4ARU4/ZXeRCD2pNk3C1HuD3pNnuRxmgDn3W:QzpVS3gfZTRzk3
TLSH
T1F6869F3095D08BE4CD249335ED5272F899A56DC8C2149D27AFA6BD40BE3A707E77C20E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_83fee34fffeee580961deb4c0628942a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-07-05_83fee34fffeee580961deb4c0628942a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 8.0MB

2026-07-05_83fee34fffeee580961deb4c0628942a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH a57639051405dc837a70f6953bdc5de8
SHA256 6b7ba3b7b40a24b5052e05a3e2e4b761a2dcc7aa501cd70732f343a407455c1c
MD5 83fee34fffeee580961deb4c0628942a
SHA1 38fd7835ed29b66460e46bbba9bd914c7a0c7f05
SHA512 a45bbd5b6f027f7d99b9c2a9e86ff9bdd91a7f3f74c015893935f9ae86a668b5eb248df54fdbfbebc7371d8fd7bc9f2667acff5756b67e6d93ab9ea9ab9e50ef
SSDEEP 196608:QzrlmQRS4bABcTr7SfHXLhpsPCKZy4ARU4/ZXeRCD2pNk3C1HuD3pNnuRxmgDn3W:QzpVS3gfZTRzk3
TLSH
T1F6869F3095D08BE4CD249335ED5272F899A56DC8C2149D27AFA6BD40BE3A707E77C20E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables referencing virtualization MAC addresses
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2051696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

iphlpapi

GetAdaptersInfo

kernel32

GetFileAttributesA Sleep GetCurrentProcessId GlobalMemoryStatusEx GetSystemInfo LocalFree FormatMessageA GetLocaleInfoEx QueryPerformanceCounter GetSystemTimePreciseAsFileTime CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI CloseHandle GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW WriteConsoleW RtlPcToFileHeader RaiseException RtlUnwindEx RtlLookupFunctionEntry SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetCPInfo IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapAlloc GetFileType VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetStringTypeW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap FlushFileBuffers CreateFileW ReadFile ReadConsoleW HeapSize HeapReAlloc SetEndOfFile

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

285KB

Virtual Size

284KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data01

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data02

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data03

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data04

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data05

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data01_

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data02_

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data03_

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data04_

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data05_

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_83fee34fffeee580961deb4c0628942a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

iphlpapi

kernel32

generic