2026-07-11_b51d67cfb5a25c50d5d6946303391384_cobalt-strike_icedid_luca-stealer_njrat_satacom

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-11_b51d67cfb5a25c50d5d6946303391384_cobalt-strike_icedid_luca-stealer_njrat_satacom
Size 530KB
Sample260711-evmtbsbt7l
SHA256 b91dc778319958d15057db5e96e33f04425aa4b1fdbc1321644d7e6324160161
MD5 b51d67cfb5a25c50d5d6946303391384
SHA1 5714c626d45d46ed0ba193425d16d5d277947c91
SHA512 4eef3b9df94d8d96edded97db2945f45b610056ea0599943e1e930c83f76b411655ba9c3964e937a45c095f2eb01a29a4f73106888c4d468c2a6f95b7dbcbd17
SSDEEP 12288:QbAofrUqbJ39glW1F16fUh3HkYCZ3wHsJ/X9:QEI3zFh3EH3N59
TLSH
T19EB45D65E66803F9E067E2F8CD538902E7727C460371969F13B06A771F276628E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-11_b51d67cfb5a25c50d5d6946303391384_cobalt-strike_icedid_luca-stealer_njrat_satacom

File Explorer

2026-07-11_b51d67cfb5a25c50d5d6946303391384_cobalt-strike_icedid_luca-stealer_njrat_satacom

.exe 530KB

2026-07-11_b51d67cfb5a25c50d5d6946303391384_cobalt-strike_icedid_luca-stealer_njrat_satacom

IMPHASH bc7cf31860080d9b4ff55ea2ba38f2a3
SHA256 b91dc778319958d15057db5e96e33f04425aa4b1fdbc1321644d7e6324160161
MD5 b51d67cfb5a25c50d5d6946303391384
SHA1 5714c626d45d46ed0ba193425d16d5d277947c91
SHA512 4eef3b9df94d8d96edded97db2945f45b610056ea0599943e1e930c83f76b411655ba9c3964e937a45c095f2eb01a29a4f73106888c4d468c2a6f95b7dbcbd17
SSDEEP 12288:QbAofrUqbJ39glW1F16fUh3HkYCZ3wHsJ/X9:QEI3zFh3EH3N59
TLSH
T19EB45D65E66803F9E067E2F8CD538902E7727C460371969F13B06A771F276628E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

220924

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetCloseHandle InternetCheckConnectionA HttpQueryInfoW HttpSendRequestA HttpOpenRequestA InternetReadFile InternetConnectA InternetOpenW

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

kernel32

CreateFileW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage DeleteFileA GetTempPathA GetTempFileNameA CloseHandle Sleep TerminateProcess OpenProcess CopyFileA CreateToolhelp32Snapshot Process32FirstW Process32NextW Process32First Process32Next GetFinalPathNameByHandleW ContinueDebugEvent WaitForDebugEvent DebugActiveProcess DebugActiveProcessStop GetLastError OpenThread SuspendThread ResumeThread CreateProcessA GetThreadContext SetThreadContext WriteConsoleW ReadProcessMemory Thread32First Thread32Next GetFileAttributesA ExpandEnvironmentStringsA GetVolumeInformationA CreateFileA FindClose FindFirstFileA FindNextFileA GetFileSize ReadFile GlobalMemoryStatusEx GetSystemTime lstrlenW GetComputerNameA GetTimeZoneInformation WideCharToMultiByte GetUserDefaultUILanguage GetLocaleInfoEx HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW FormatMessageA LocalFree FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetModuleHandleW GetProcAddress RtlUnwind GetFileInformationByHandleEx MultiByteToWideChar GetStringTypeW GetCurrentThreadId GetLogicalProcessorInformationEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent FreeLibrary GetModuleHandleExW GetCurrentProcess ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType VirtualProtect

user32

GetKeyboardLayout GetSystemMetrics

shell32

SHGetFolderPathA

ole32

CoInitializeSecurity CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

VariantClear SysFreeString SysAllocString

advapi32

GetUserNameA

Name

.text

Size

376KB

Virtual Size

380KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

118KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

13KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-11_b51d67cfb5a25c50d5d6946303391384_cobalt-strike_icedid_luca-stealer_njrat_satacom

wininet

version

kernel32

user32

shell32

ole32

oleaut32

advapi32

generic