2026-07-20_af18e6b2253aa07c14198598b145a807_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_af18e6b2253aa07c14198598b145a807_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 2.0MB
Sample260720-c6sgvafw2x
SHA256 1ec93fecca4ff4b288745e84b3620930f750a1d16dbea32bbf30f89992ff603c
MD5 af18e6b2253aa07c14198598b145a807
SHA1 af50b91f840453c70c717b34c9bd252fb60405e7
SHA512 a571347f96b765df67a2eff2cbcc2c25cebe2dffa3158e04e93f2075796fbcafb08761b06ffa1d68837702a4f562af2cf29e0f8e90a75d484aafb1764c6510a7
SSDEEP 24576:Jhrk9+p+Nf57brrsQctnk9hJdha/7snhSL0zbWnjgMB1P38oZiXnhAzJtpi:Jhhp+NiVk9uzTgMB5roXnOt
TLSH
T14FA5CF02B709429DC5275D398AE5D357F775BC042F6842CBB2C51BE8DEAB5E00AFA381
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_af18e6b2253aa07c14198598b145a807_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-07-20_af18e6b2253aa07c14198598b145a807_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 2.0MB

2026-07-20_af18e6b2253aa07c14198598b145a807_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 3d270cc9f2d9c8047ca1df42c5464ee6
SHA256 1ec93fecca4ff4b288745e84b3620930f750a1d16dbea32bbf30f89992ff603c
MD5 af18e6b2253aa07c14198598b145a807
SHA1 af50b91f840453c70c717b34c9bd252fb60405e7
SHA512 a571347f96b765df67a2eff2cbcc2c25cebe2dffa3158e04e93f2075796fbcafb08761b06ffa1d68837702a4f562af2cf29e0f8e90a75d484aafb1764c6510a7
SSDEEP 24576:Jhrk9+p+Nf57brrsQctnk9hJdha/7snhSL0zbWnjgMB1P38oZiXnhAzJtpi:Jhhp+NiVk9uzTgMB5roXnOt
TLSH
T14FA5CF02B709429DC5275D398AE5D357F775BC042F6842CBB2C51BE8DEAB5E00AFA381
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

523060

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\NullShade\Loader\builds\Nullshade.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GetFileAttributesW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar ReleaseMutex CreateMutexW TerminateProcess GetVolumeInformationA GetComputerNameA GlobalAlloc GlobalUnlock GlobalLock GlobalFree WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetLocaleInfoA GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind GetExitCodeThread HeapFree HeapAlloc GetModuleHandleW GetStdHandle GetModuleFileNameW ExitProcess GetCurrentProcess IsProcessorFeaturePresent ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError LoadLibraryA GetProcAddress GetLastError CloseHandle SetEndOfFile RtlUnwindEx RtlLookupFunctionEntry RaiseException WriteConsoleW HeapSize CreateFileW SetStdHandle RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW GetEnvironmentStringsW WakeAllConditionVariable GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SleepConditionVariableSRW TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive WriteFile RtlCaptureContext RtlUnwind GetSystemTimePreciseAsFileTime WaitForSingleObjectEx Sleep GetCurrentThreadId

user32

DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow SetLayeredWindowAttributes SetWindowPos SetFocus DispatchMessageW UpdateWindow SetActiveWindow SetForegroundWindow SetWindowRgn GetClientRect MessageBoxA ScreenToClient GetWindowLongW SetWindowLongW GetActiveWindow MessageBoxW SetWindowTextW PeekMessageW TranslateMessage GetSystemMetrics ReleaseCapture LoadCursorW ClientToScreen GetCursorPos SetCursor SetCursorPos GetForegroundWindow IsWindowUnicode SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard AllowSetForegroundWindow

gdi32

DeleteObject CreateRoundRectRgn

advapi32

RegCreateKeyExA RegGetValueA RegSetValueExA RegCloseKey

shell32

ShellExecuteA ShellExecuteW

ole32

CreateStreamOnHGlobal CoCreateInstance CoInitializeEx

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpAddRequestHeaders

dwmapi

DwmExtendFrameIntoClientArea

ws2_32

setsockopt closesocket connect htons recv select send socket gethostbyname WSAStartup WSACleanup WSAGetLastError accept bind inet_addr listen

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

701KB

Virtual Size

700KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_af18e6b2253aa07c14198598b145a807_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

d3d11

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

dwmapi

ws2_32

imm32

d3dcompiler_47

generic