2026-07-30_1039d161b62161c21449f54e0d7b273c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

General

Target
2026-07-30_1039d161b62161c21449f54e0d7b273c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 376KB
Sample260730-gpgfgadn8v
SHA256 efcb8e56ba64860938a4cccbe95dfca80d5262c5525d2d31947139a3fa19fa19
MD5 1039d161b62161c21449f54e0d7b273c
SHA1 f1b2df95603e50eea35bd0e3ba5f590616f494f8
SHA512 77a53e15d6faee4734ad4e58cf55c2c25ecf0f4bea6d79af45b0e04876e8f96375c48aaef91eb0ee71ac279366db7a7a6f518106020e6d410b2b01173e543e6f
SSDEEP 6144:PYxRHp8iU58MVu0oorV9bpyySczYEru6L:wbTUL5oo1yFczYEj
TLSH
T1E9848C15F7A914F9E9A7C13CC9424906EA72BC564761EACF03A04B972F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_1039d161b62161c21449f54e0d7b273c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-07-30_1039d161b62161c21449f54e0d7b273c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 376KB

2026-07-30_1039d161b62161c21449f54e0d7b273c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 31c95136c8f4975d5eff7e829941b1ed
SHA256 efcb8e56ba64860938a4cccbe95dfca80d5262c5525d2d31947139a3fa19fa19
MD5 1039d161b62161c21449f54e0d7b273c
SHA1 f1b2df95603e50eea35bd0e3ba5f590616f494f8
SHA512 77a53e15d6faee4734ad4e58cf55c2c25ecf0f4bea6d79af45b0e04876e8f96375c48aaef91eb0ee71ac279366db7a7a6f518106020e6d410b2b01173e543e6f
SSDEEP 6144:PYxRHp8iU58MVu0oorV9bpyySczYEru6L:wbTUL5oo1yFczYEj
TLSH
T1E9848C15F7A914F9E9A7C13CC9424906EA72BC564761EACF03A04B972F237E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

311296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileA FindClose FindFirstFileA FindNextFileA CloseHandle GetCurrentProcess GetProcessId OpenProcess VirtualProtectEx VirtualQueryEx ReadProcessMemory GetModuleHandleA GetProcAddress CreateToolhelp32Snapshot Process32First Process32Next WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW SetEndOfFile WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW

ntdll

RtlCaptureContext RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader RtlVirtualUnwind RtlUnwind

Name

.text

Size

187KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd7cb

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_1039d161b62161c21449f54e0d7b273c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

kernel32

ntdll

generic