2026-08-02_d9355a2d2a8b5d875a3b6bbc15d81331_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_d9355a2d2a8b5d875a3b6bbc15d81331_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 1.9MB
Sample260802-mqma1axyhz
SHA256 e008e87b1f40bdb190be743c77e6eb09bc3dbc80b0e18a2e3af88ced835a82a6
MD5 d9355a2d2a8b5d875a3b6bbc15d81331
SHA1 f863039e83d5cbc69c06ca396ea98b825282006e
SHA512 7406cc519ecf4e5ad5d78c28be6ced54df0dbe2e334a9e10da7aef08a9c15f0f2bd1d0d64394a1787e7b08f0e0056e4498b7ae6842274200ce243f237755afd8
SSDEEP 49152:vWbxJMMoj15e4w8xhACEKzs57Xci5NLd:YojPJw80Rp7XcO1
TLSH
T17B95E017B69401FBF1B3C174CD127906D676B8D64370AAEF03D0D9A62F275A08A3E792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Detects executables referencing many VPN software clients. Observed in infosteslers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_VPN

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_d9355a2d2a8b5d875a3b6bbc15d81331_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-02_d9355a2d2a8b5d875a3b6bbc15d81331_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 1.9MB