2026-07-20_b5301ad6f065d3ad68d5dcfcace22dd7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_b5301ad6f065d3ad68d5dcfcace22dd7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 1.2MB
Sample260720-kxfexsct4j
SHA256 6cd83c6940267a0b2829d5149537e63c476b4d020a46c8bfe78f73b72000e90b
MD5 b5301ad6f065d3ad68d5dcfcace22dd7
SHA1 1284871209d005d46e26ef377aab7728561cb4d4
SHA512 ce609630e3b666cd39133a37b49be5e4b6a023961a7e9c94e14292c8d76e4d80d6155fc6604ba22f554febbf1339618e5c15c0e5212a035c25983dee208aed1e
SSDEEP 24576:EoiGfOBWXFJ5ZON6KO0NYMihr4C1d5KQUFXY/AlzvndiZo3:Eoi2OMXnOc0evGh3vnMZ
TLSH
T1B1459E46B2E640F8E0BBE178D5A1651FE972781507308ADF17D409692F73BE04BBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_b5301ad6f065d3ad68d5dcfcace22dd7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-07-20_b5301ad6f065d3ad68d5dcfcace22dd7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 1.2MB

2026-07-20_b5301ad6f065d3ad68d5dcfcace22dd7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 36bf3a3e35980bf44a07d2925b8a017e
SHA256 6cd83c6940267a0b2829d5149537e63c476b4d020a46c8bfe78f73b72000e90b
MD5 b5301ad6f065d3ad68d5dcfcace22dd7
SHA1 1284871209d005d46e26ef377aab7728561cb4d4
SHA512 ce609630e3b666cd39133a37b49be5e4b6a023961a7e9c94e14292c8d76e4d80d6155fc6604ba22f554febbf1339618e5c15c0e5212a035c25983dee208aed1e
SSDEEP 24576:EoiGfOBWXFJ5ZON6KO0NYMihr4C1d5KQUFXY/AlzvndiZo3:Eoi2OMXnOc0evGh3vnMZ
TLSH
T1B1459E46B2E640F8E0BBE178D5A1651FE972781507308ADF17D409692F73BE04BBBB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

665112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

PtInRect SetFocus IsIconic SetWindowDisplayAffinity SetWindowPos SetLayeredWindowAttributes DestroyWindow CreateWindowExA UnregisterClassA RegisterClassA PostQuitMessage GetWindowLongPtrA PeekMessageA EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard ScreenToClient SetCursor ReleaseDC SetWindowLongPtrA GetDpiForWindow DefWindowProcA GetDC IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState DefWindowProcW GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout GetCursorInfo LoadCursorA GetClipCursor GetSystemMetrics FindWindowExA mouse_event GetAncestor CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW WindowFromPoint ClientToScreen GetCursorPos MapVirtualKeyW GetAsyncKeyState PostThreadMessageA DispatchMessageA TranslateMessage GetMessageA GetWindow GetWindowThreadProcessId GetTopWindow GetClassNameA SetCursorPos GetWindowRect GetWindowTextA SetForegroundWindow GetForegroundWindow SendInput BringWindowToTop IsWindowVisible ShowWindow AttachThreadInput FindWindowA GetClientRect

gdi32

GetDeviceCaps

winmm

timeEndPeriod timeBeginPeriod

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmExtendFrameIntoClientArea

winhttp

WinHttpCloseHandle WinHttpReadData WinHttpQueryDataAvailable WinHttpOpen WinHttpConnect WinHttpQueryOption WinHttpSetTimeouts WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest

crypt32

CryptHashCertificate CertFreeCertificateContext

advapi32

CryptAcquireContextW CryptReleaseContext

ntdll

RtlCaptureContext RtlPcToFileHeader RtlVirtualUnwind RtlUnwindEx RtlLookupFunctionEntry

d3dcompiler_47

D3DCompile

kernel32

FlsSetValue FlsGetValue FlsAlloc SetLastError RaiseException GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx CompareStringW LCMapStringW GetLocaleInfoW FlsFree GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW InitializeSListHead GetModuleHandleW GetStartupInfoW SleepConditionVariableSRW WakeAllConditionVariable OpenFileMappingA UnmapViewOfFile MapViewOfFile GetCurrentProcessId IsProcessorFeaturePresent EnterCriticalSection InitializeCriticalSection GetLastError GlobalFree GlobalLock GlobalUnlock GlobalAlloc OutputDebugStringA IsDBCSLeadByte GetLocaleInfoA MultiByteToWideChar FreeLibrary K32GetProcessMemoryInfo Module32Next Module32First Process32Next Process32First SetEndOfFile ReadFile WriteFile GetCommandLineA GetCommandLineW HeapSize CreateFileW HeapReAlloc SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose FlushFileBuffers OutputDebugStringW SetFilePointerEx GetFileSizeEx GetConsoleOutputCP ReadConsoleW GetConsoleMode EnumSystemLocalesW IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect GetUserDefaultLCID IsValidLocale LeaveCriticalSection GetModuleHandleA Sleep VirtualQueryEx GetSystemInfo GetCurrentThreadId ReadProcessMemory GetTickCount WideCharToMultiByte CloseHandle CreateThread GetSystemTimeAsFileTime GetModuleFileNameA GetModuleHandleExA GetCurrentProcess CreateToolhelp32Snapshot GetProcAddress ExitProcess TerminateProcess LoadLibraryA GetStdHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute SetUnhandledExceptionFilter SetConsoleCtrlHandler Beep ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared QueryPerformanceCounter QueryPerformanceFrequency OpenProcess LoadLibraryExW

shell32

ShellExecuteW

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

Name

.text

Size

871KB

Virtual Size

871KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

300KB

Virtual Size

300KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_b5301ad6f065d3ad68d5dcfcace22dd7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

user32

gdi32

winmm

d3d11

dwmapi

winhttp

crypt32

advapi32

ntdll

d3dcompiler_47

kernel32

shell32

imm32

generic