2026-07-06_20af8b16f2a58a493cc9acac3150568a_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_20af8b16f2a58a493cc9acac3150568a_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc
Size 3.1MB
Sample260707-flea9sfs7p
SHA256 236395024d2d9c6ccf21db481a61e4d6439ed413c0df5a4ab25993a54d466146
MD5 20af8b16f2a58a493cc9acac3150568a
SHA1 de824e8eaa8950a76b8fec865005016819319f2b
SHA512 2c428e3dc12ec0157e02e70dfb936bd9bb46958cb55303c4f62c05d95142b58ca88225bccdd9ea0a868efc806ff8340d792640d24172a5549f54fae3a6c51d32
SSDEEP 49152:SeYpKr3IoTumb5uFGNLvmjQ0FGXzLKjObS:SKWkmCg5sKjOb
TLSH
T1B2E59E02F3A548FAD4A7E23885D7170AF771BC9507A2ABCF136456621F236E49D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_20af8b16f2a58a493cc9acac3150568a_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc

File Explorer

2026-07-06_20af8b16f2a58a493cc9acac3150568a_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc

.exe 3.1MB

2026-07-06_20af8b16f2a58a493cc9acac3150568a_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc

IMPHASH 51ae735f78127d437e74e2d7a3af7920
SHA256 236395024d2d9c6ccf21db481a61e4d6439ed413c0df5a4ab25993a54d466146
MD5 20af8b16f2a58a493cc9acac3150568a
SHA1 de824e8eaa8950a76b8fec865005016819319f2b
SHA512 2c428e3dc12ec0157e02e70dfb936bd9bb46958cb55303c4f62c05d95142b58ca88225bccdd9ea0a868efc806ff8340d792640d24172a5549f54fae3a6c51d32
SSDEEP 49152:SeYpKr3IoTumb5uFGNLvmjQ0FGXzLKjObS:SKWkmCg5sKjOb
TLSH
T1B2E59E02F3A548FAD4A7E23885D7170AF771BC9507A2ABCF136456621F236E49D3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CreateProcessA DeleteCriticalSection DeleteFileA EnterCriticalSection FlsAlloc FlsGetValue FlsSetValue FormatMessageA GetCurrentThreadId GetLastError GetModuleHandleW GetProcAddress GetStartupInfoA GetSystemTimeAsFileTime GetTempPathA GetThreadId InitOnceExecuteOnce InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte __C_specific_handler

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf _fileno _fseeki64 _ftelli64 _setmode _wfopen fclose fflush fopen fputc fputwc fread fseek fwrite getc setbuf setvbuf ungetc

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___argv __p__acmdln __sys_nerr _beginthreadex _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal strerror strerror_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove

api-ms-win-crt-string-l1-1-0

_iswalpha_l _iswcntrl_l _iswdigit_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _strcoll_l _strdup _strxfrm_l _tolower_l _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsxfrm_l isdigit isspace isxdigit mbrlen memset strcmp strlen strncmp strnlen tolower toupper wcslen wcsnlen

api-ms-win-crt-time-l1-1-0

_strftime_l

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

api-ms-win-crt-convert-l1-1-0

_strtod_l mbrtowc mbsrtowcs strtof strtol strtoll strtoul strtoull wcrtomb wcrtomb_s wcstod wcstol wcstoll wcstoul wcstoull

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

578KB

Virtual Size

577KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

132KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_20af8b16f2a58a493cc9acac3150568a_cobalt-strike_icedid_luca-stealer_njrat_ryuk_satacom_stealc

kernel32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic