2026-08-03_291a4cdeb673cc71bafcf8c569d030a1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_291a4cdeb673cc71bafcf8c569d030a1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 535KB
Sample260803-sbf4bstvcv
SHA256 aea9bb200bf5f78db83e57680ec3a874e02e34470b17133009b59407581ba8ea
MD5 291a4cdeb673cc71bafcf8c569d030a1
SHA1 b513b6c3fae270a0885feb2ae84b687f54982ec9
SHA512 f7a4fdac2c3729d3ae95c2ed060a079d2cff714a56925f39ea8d97f1c9a36cf824f9ee247fbd1758fd2d6c3f63cfc4f03f0f84119608c9a6f7b60cf598bbcf30
SSDEEP 12288:18auPCmLsMbrmgNZFaM0Qyz7rJKjWAhu:RmgSqiFaFQyjJKZQ
TLSH
T15CC48D62A15014F9E83BC479D407C532EA627C2743B0A5D713E49F6B7E2B6A08D3FB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_291a4cdeb673cc71bafcf8c569d030a1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-03_291a4cdeb673cc71bafcf8c569d030a1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 535KB

2026-08-03_291a4cdeb673cc71bafcf8c569d030a1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 469184df104f369887ea85ef4ae04f6f
SHA256 aea9bb200bf5f78db83e57680ec3a874e02e34470b17133009b59407581ba8ea
MD5 291a4cdeb673cc71bafcf8c569d030a1
SHA1 b513b6c3fae270a0885feb2ae84b687f54982ec9
SHA512 f7a4fdac2c3729d3ae95c2ed060a079d2cff714a56925f39ea8d97f1c9a36cf824f9ee247fbd1758fd2d6c3f63cfc4f03f0f84119608c9a6f7b60cf598bbcf30
SSDEEP 12288:18auPCmLsMbrmgNZFaM0Qyz7rJKjWAhu:RmgSqiFaFQyjJKZQ
TLSH
T15CC48D62A15014F9E83BC479D407C532EA627C2743B0A5D713E49F6B7E2B6A08D3FB52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shlwapi

PathFindFileNameA StrStrIA

netapi32

NetUserSetInfo

kernel32

CreateDirectoryA CreateFileA FindClose FindFirstFileA FindNextFileA GetDriveTypeA GetFileSize GetFullPathNameA GetLogicalDrives ReadFile WriteFile GetTempPathA CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess CreateProcessA OpenProcess GetLocalTime GetWindowsDirectoryA GetModuleFileNameA GetEnvironmentVariableA LoadResource LockResource SizeofResource lstrcmpiA QueryFullProcessImageNameA FindResourceA MultiByteToWideChar CreateToolhelp32Snapshot Process32First Process32Next SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc ReadConsoleW SetFilePointerEx GetProcessHeap CreateFileW HeapSize WriteConsoleW SetEndOfFile GetModuleHandleA WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread GetLogicalProcessorInformationEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter GetSystemTimePreciseAsFileTime WakeAllConditionVariable RtlUnwind EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetStdHandle GetModuleFileNameW ExitProcess GetProcAddress GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx

user32

CreateWindowExA DestroyWindow DefWindowProcA PeekMessageA DispatchMessageA ShowWindow SetWindowPos MessageBoxA IsWindow SystemParametersInfoA RegisterClassExA

shell32

ShellExecuteA

advapi32

RegOpenKeyExA RegCloseKey GetUserNameA GetTokenInformation OpenProcessToken RegSetValueExA

Name

.text

Size

208KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

224KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_291a4cdeb673cc71bafcf8c569d030a1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

shlwapi

netapi32

kernel32

user32

shell32

advapi32

generic