2026-08-02_8d59c2db2634aa829e8154d1f834e7eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_8d59c2db2634aa829e8154d1f834e7eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 4.5MB
Sample260802-j8qvcsfl4x
SHA256 ba9d9358d4e4220e60157254132c3cf78b8f0d694e450372a9aff7cb0dddbba1
MD5 8d59c2db2634aa829e8154d1f834e7eb
SHA1 03b526b44234287778367d09f35d6752a2f7d2ba
SHA512 18055e6f1cbdfa864cd38490493cc074f1837c1d4eb291bac4815263fda0c5d39a1e786f23a84d63d17021a067b7af92461102ec6f5f3b27d4ce62fb1828b975
SSDEEP 98304:C1yhpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+R1E:LGpELcoR1E
TLSH
T16B268CC6BE88F5E4C0A48834B916D57DD673BC7A8A11468732D7FB1F2A37180453B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-02_8d59c2db2634aa829e8154d1f834e7eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 4.5MB

2026-08-02_8d59c2db2634aa829e8154d1f834e7eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH aee78f541e295c18115cfd0617bfffc5
SHA256 ba9d9358d4e4220e60157254132c3cf78b8f0d694e450372a9aff7cb0dddbba1
MD5 8d59c2db2634aa829e8154d1f834e7eb
SHA1 03b526b44234287778367d09f35d6752a2f7d2ba
SHA512 18055e6f1cbdfa864cd38490493cc074f1837c1d4eb291bac4815263fda0c5d39a1e786f23a84d63d17021a067b7af92461102ec6f5f3b27d4ce62fb1828b975
SSDEEP 98304:C1yhpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+R1E:LGpELcoR1E
TLSH
T16B268CC6BE88F5E4C0A48834B916D57DD673BC7A8A11468732D7FB1F2A37180453B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

02:d2:37:f2:57:c8:36:01:38:91:f4:cc:3a:57:c6:70:c3:f7:df:1c:5e:28:48:8e:c1:71:0c:42:13:11:eb:6b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 10, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:01:3f:0b:92:73:a8:c5:31:99:00:00:00:00:01:01

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 5, 2026 - Mar 3, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:14:8d:cd:23:44:ee:06:df:72:00:01:00:00:02:14

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

503152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\dbs\sh\odct\0710_133639\client\onedrive\Product\UX\Exe\obj\amd64\OneDrive.pdb

kernel32

GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetVolumePathNameW ReadFile RemoveDirectoryW SetFileAttributesW SetFileInformationByHandle SetFilePointer GetCompressedFileSizeW FindFirstFileNameW IsDebuggerPresent SetHandleInformation CreatePipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus DeviceIoControl SetEvent OpenMutexW CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait IsWow64Process GlobalAlloc GlobalUnlock GlobalLock GlobalFree ReadDirectoryChangesW CreateSymbolicLinkW CompareStringOrdinal WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessIoCounters GetPrivateProfileStringW WritePrivateProfileStringW CopyFileW MoveFileExW ReplaceFileW GetComputerNameW RegisterApplicationRestart GetFileInformationByHandleEx OpenFileById GetModuleHandleW GetDllDirectoryW MultiByteToWideChar WriteConsoleW ReadConsoleW SetEndOfFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle GetFileSize FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindNextFileW FindFirstFileExW SetFilePointerEx GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetTimeFormatW GetDateFormatW GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindVolumeClose FindNextVolumeW FindFirstVolumeW CreateFileW CreateDirectoryW SetThreadInformation GetSystemTimes ProcessIdToSessionId SetProcessShutdownParameters GetExitCodeProcess GetProcessTimes WaitForMultipleObjects CreateEventW ReleaseMutex GetLongPathNameW SetLastError VerifyVersionInfoW GetProductInfo VerSetConditionMask ExpandEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW K32GetModuleFileNameExW GetUserDefaultLCID GetUserGeoID LCIDToLocaleName SystemTimeToFileTime MoveFileW LocalAlloc GetModuleFileNameW GetNativeSystemInfo GetVersionExW GetSystemTimeAsFileTime GetSystemTime GlobalMemoryStatusEx OpenProcess TerminateProcess GetCurrentProcess CreateMutexW WaitForSingleObject InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc FindFirstFileW FindClose DeleteFileW LCMapStringW CloseHandle CreateProcessW GetCurrentProcessId FreeLibrary GetProcAddress LoadLibraryExW LoadLibraryW SetDllDirectoryW WriteFile GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread VirtualProtect IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext FlsFree FlsSetValue FlsGetValue FlsAlloc RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable GetCPInfo CompareStringEx LCMapStringEx EncodePointer Sleep LocalFree DeleteCriticalSection DecodePointer GetLastError SetEnvironmentVariableW GetLocaleInfoEx GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimePreciseAsFileTime QueryPerformanceCounter GetStringTypeW LeaveCriticalSection EnterCriticalSection RaiseException OutputDebugStringW

user32

EnumWindows GetClassNameW GetWindowThreadProcessId SystemParametersInfoW PostMessageW GetMessageW TranslateMessage DispatchMessageW RegisterPowerSettingNotification UnregisterPowerSettingNotification RegisterSuspendResumeNotification SendMessageTimeoutW CloseClipboard EmptyClipboard RegisterClipboardFormatW UnregisterSuspendResumeNotification RegisterClassW CreateWindowExW DestroyWindow ShowWindow OpenClipboard SetClipboardData

advapi32

CreateServiceW AdjustTokenPrivileges EqualSid CreateProcessWithTokenW GetUserNameW SetFileSecurityW ConvertSidToStringSidW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegDeleteTreeW RegUnLoadKeyW RegNotifyChangeKeyValue RegLoadKeyW RegEnumKeyW RegDeleteKeyExW RegCreateKeyTransactedW IsWellKnownSid GetAclInformation FreeSid DuplicateTokenEx CreateWellKnownSid AllocateAndInitializeSid CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegGetValueW RegSetKeyValueW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW GetTokenInformation OpenProcessToken

shell32

SHSetKnownFolderPath ord526 ShellExecuteW CommandLineToArgvW SHFileOperationW SHGetSpecialFolderPathW SHGetKnownFolderPath SHChangeNotify SHParseDisplayName SHGetFolderPathAndSubDirW ShellExecuteExW SHCreateItemFromParsingName SHGetPropertyStoreFromParsingName SHAssocEnumHandlers SHCreateDirectoryExW SHGetFolderPathW

ole32

CoInitialize CoInitializeSecurity CoUninitialize StringFromCLSID CoTaskMemFree CoCreateInstance StringFromGUID2 CreateBindCtx CoCreateGuid CoInitializeEx CoSetProxyBlanket CreateItemMoniker GetRunningObjectTable

oleaut32

LoadTypeLi LoadRegTypeLi GetRecordInfoFromTypeInfo

crypt32

CertFindExtension CryptStringToBinaryW CryptBinaryToStringW

rpcrt4

UuidCreate RpcBindingFree RpcBindingFromStringBindingW RpcBindingVectorFree RpcStringBindingComposeW RpcStringFreeW RpcServerInqBindings RpcServerRegisterIfEx RpcServerUnregisterIf RpcServerUseProtseqW RpcBindingSetAuthInfoExW RpcEpRegisterW RpcEpUnregister RpcServerInqCallAttributesW

secur32

GetUserNameExW

shlwapi

PathRemoveFileSpecW PathIsDirectoryEmptyW SHCreateStreamOnFileW AssocQueryStringW SHRegGetBoolUSValueW SHRegGetPathW SHRegGetValueW SHSetValueW SHGetValueA SHDeleteValueW SHDeleteKeyW PathIsPrefixW SHRegGetUSValueW SHGetValueW StrStrIW PathIsDirectoryW PathFileExistsW PathStripPathW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

wininet

InternetCheckConnectionW InternetCanonicalizeUrlW

wtsapi32

WTSEnumerateSessionsW WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken

userenv

CreateEnvironmentBlock GetDefaultUserProfileDirectoryW

Name

.text

Size

669KB

Virtual Size

669KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

206KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_8d59c2db2634aa829e8154d1f834e7eb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

rpcrt4

secur32

shlwapi

version

wininet

wtsapi32

userenv

generic