2026-07-29_22ef4453f5be7f61774f1275e192551b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_22ef4453f5be7f61774f1275e192551b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_wannacry
Size 6.0MB
Sample260730-aksvdavgpg
SHA256 8e788cf30ff859d895ae2776d1d92ab7e223793a4aa2bde0ce8dea8b222ba9e3
MD5 22ef4453f5be7f61774f1275e192551b
SHA1 5cadb7636debcca8e312cd4818dee6c641bccc0a
SHA512 5a87bdab9281795305eeceadaaa54b53e222829558fa4b00e979063b1f7e1274a96bca3785af5868fee48f2aeb64065ecd78f08b90fa4c362d51547af6211c38
SSDEEP 49152:lPluMuH146HbZs/OiyahZjUSzJjtrIzVObOomr4etBOoxVx2tPr235OC3RXbqgUL:V0V46HmGobu0KBOoPeq5/9RDBMgk
TLSH
T12856D01BB7A801E8C0A7D5B989175D17FAB27809133697DB17A0895E2F23BF05E3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects binaries and memory artifacts referencing sandbox product IDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxProductID

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_22ef4453f5be7f61774f1275e192551b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_wannacry

File Explorer

2026-07-29_22ef4453f5be7f61774f1275e192551b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_wannacry

.exe 6.0MB

2026-07-29_22ef4453f5be7f61774f1275e192551b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_wannacry

IMPHASH 18504dcb82dc3b2ddf19caa783d7e76f
SHA256 8e788cf30ff859d895ae2776d1d92ab7e223793a4aa2bde0ce8dea8b222ba9e3
MD5 22ef4453f5be7f61774f1275e192551b
SHA1 5cadb7636debcca8e312cd4818dee6c641bccc0a
SHA512 5a87bdab9281795305eeceadaaa54b53e222829558fa4b00e979063b1f7e1274a96bca3785af5868fee48f2aeb64065ecd78f08b90fa4c362d51547af6211c38
SSDEEP 49152:lPluMuH146HbZs/OiyahZjUSzJjtrIzVObOomr4etBOoxVx2tPr235OC3RXbqgUL:V0V46HmGobu0KBOoPeq5/9RDBMgk
TLSH
T12856D01BB7A801E8C0A7D5B989175D17FAB27809133697DB17A0895E2F23BF05E3D720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects binaries and memory artifacts referencing sandbox product IDs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1698536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCrackUrl WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest

crypt32

CryptBinaryToStringA CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptEncrypt BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptDecrypt BCryptGenerateSymmetricKey BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptFinishHash

gdiplus

GdiplusShutdown GdipSaveImageToStream GdipGetImageEncodersSize GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusStartup

kernel32

IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread GetLastError SetThreadAffinityMask GetSystemFirmwareTable GetPhysicallyInstalledSystemMemory TerminateProcess LocalAlloc GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW QueryPerformanceFrequency Process32FirstW CloseHandle GetNativeSystemInfo LocalFree ExitProcess GetModuleHandleW WideCharToMultiByte SleepEx BuildCommDCBAndTimeoutsA EnumSystemFirmwareTables QueryPerformanceCounter VirtualQuery GetComputerNameA GetModuleFileNameA SizeofResource GetDriveTypeA EnumResourceNamesW EndUpdateResourceW LockResource LoadResource FindResourceW SetFileAttributesA UpdateResourceW GetLogicalDriveStringsA FreeLibrary BeginUpdateResourceW QueryFullProcessImageNameW LoadLibraryExW ReadFile FindFirstFileA WriteFile CreateNamedPipeW FindNextFileA PeekNamedPipe FindClose GetCurrentThreadId GetTempPathA GetCurrentProcessId CreateProcessW GetTickCount ConnectNamedPipe FlushFileBuffers GetFileSizeEx SetFilePointer GetVolumeInformationA CreateFileW GetLocaleInfoW MoveFileExW UnhandledExceptionFilter GetTickCount64 CreateFileA GetFileSize CreateProcessA GetTimeZoneInformation GetSystemInfo GlobalMemoryStatusEx FindFirstFileW FindNextFileW GetCurrentProcess RemoveDirectoryW WaitForSingleObject SetFileAttributesW MultiByteToWideChar CopyFileA CreateThread GetLocalTime CreateDirectoryA AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA HeapReAlloc RaiseException LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile RtlUnwind CreateFileMappingA LockFileEx DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile ExitThread GetFileType SetFilePointerEx GetConsoleOutputCP GetConsoleMode VirtualProtect GetSystemTime IsValidLocale GetUserDefaultLCID CompareStringW GetVersionExW LCMapStringW EnumSystemLocalesW ReadConsoleW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW DeleteFileW GetProcAddress FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteDC DeleteObject GetDeviceCaps BitBlt

advapi32

CryptAcquireContextA RegSetValueExA RegOpenKeyExA GetUserNameA LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegQueryValueExA RegEnumKeyExW OpenProcessToken RegOpenKeyExW RegGetValueW GetTokenInformation CryptAcquireContextW CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext

shell32

ShellExecuteA

setupapi

SetupDiDestroyDeviceInfoList SetupDiOpenDevRegKey SetupDiGetDevicePropertyW SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo

api-ms-win-core-realtime-l1-1-1

QueryInterruptTime

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW GetExitCodeThread

api-ms-win-core-sysinfo-l1-1-0

GetLogicalProcessorInformationEx

api-ms-win-core-file-l1-1-0

FindFirstFileExW CreateDirectoryW GetFinalPathNameByHandleW SetFileInformationByHandle

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-localization-l1-2-0

GetCPInfo GetLocaleInfoEx LCMapStringEx

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryAcquireSRWLockExclusive

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW WakeAllConditionVariable

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-string-l1-1-0

GetStringTypeW CompareStringEx

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

wevtapi

EvtQuery EvtRender EvtClose EvtNext EvtCreateRenderContext

shlwapi

PathFileExistsW

ntdll

RtlInitUnicodeString

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_22ef4453f5be7f61774f1275e192551b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_wannacry

winhttp

crypt32

bcrypt

gdiplus

kernel32

gdi32

advapi32

shell32

setupapi

api-ms-win-core-realtime-l1-1-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-interlocked-l1-1-0

wevtapi

shlwapi

ntdll

generic