2026-08-03_a16d8185501058f6c2d52a0947496480_cobalt-strike_icedid_luca-stealer_njrat_satacom

General

Target
2026-08-03_a16d8185501058f6c2d52a0947496480_cobalt-strike_icedid_luca-stealer_njrat_satacom
Size 142KB
Sample260803-zh2ryafe27
SHA256 7b4d3073b5d7bd37f7a184b0861578accb6293e41a18857cafc46d8b646944e7
MD5 a16d8185501058f6c2d52a0947496480
SHA1 3a53612b48f38bc98fa67ee9749c1d5b70ec5d17
SHA512 d48feb77f80fb4fb4bd2906aeefb75a16c8fd5d67fec073086265be17ae18449bff6debc282f014f750c41b03423aae69cccfee43b5a2c5b08fcba0754a71989
SSDEEP 3072:Vl4OvB71RDi7jlDKqxA/7J7FLNMiaR7Fa0trc:/p1R27Ua47Jb2Rpaj
TLSH
T199E35B1773A534F9D1B78239C9610A06EB72783217705BEF07A4837A2F236D09D7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_a16d8185501058f6c2d52a0947496480_cobalt-strike_icedid_luca-stealer_njrat_satacom

File Explorer

2026-08-03_a16d8185501058f6c2d52a0947496480_cobalt-strike_icedid_luca-stealer_njrat_satacom

.exe 142KB

2026-08-03_a16d8185501058f6c2d52a0947496480_cobalt-strike_icedid_luca-stealer_njrat_satacom

IMPHASH 7ee0cddcfbed7746c775f8c00752c2f3
SHA256 7b4d3073b5d7bd37f7a184b0861578accb6293e41a18857cafc46d8b646944e7
MD5 a16d8185501058f6c2d52a0947496480
SHA1 3a53612b48f38bc98fa67ee9749c1d5b70ec5d17
SHA512 d48feb77f80fb4fb4bd2906aeefb75a16c8fd5d67fec073086265be17ae18449bff6debc282f014f750c41b03423aae69cccfee43b5a2c5b08fcba0754a71989
SSDEEP 3072:Vl4OvB71RDi7jlDKqxA/7J7FLNMiaR7Fa0trc:/p1R27Ua47Jb2Rpaj
TLSH
T199E35B1773A534F9D1B78239C9610A06EB72783217705BEF07A4837A2F236D09D7AB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9228

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

connect freeaddrinfo getaddrinfo WSACleanup WSAStartup socket send recv ntohl htonl closesocket

advapi32

RegCreateKeyExW RegCloseKey GetUserNameA GetTokenInformation OpenProcessToken RegSetValueExW

kernel32

SetFilePointerEx HeapSize GetProcessHeap LCMapStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW FlsFree GetStdHandle GetEnvironmentVariableW SetCurrentDirectoryA GetCurrentDirectoryA CreateFileW DeleteFileW GetFileSize ReadFile SetFileAttributesW GetTempPathW OutputDebugStringA CloseHandle GetLastError CreatePipe CreateMutexW Sleep GetCurrentProcess GetCurrentProcessId ExitProcess CreateProcessA CreateProcessW GetModuleFileNameW CopyFileW MoveFileW GetComputerNameA WriteConsoleA CompareStringW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader WriteFile TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW VirtualProtect LoadLibraryExW

shell32

SHGetFolderPathW

Name

.text

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_a16d8185501058f6c2d52a0947496480_cobalt-strike_icedid_luca-stealer_njrat_satacom

ws2_32

advapi32

kernel32

shell32

generic