2026-08-03_081da8f20cfd9eece797d40d46064d7d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

General

Target
2026-08-03_081da8f20cfd9eece797d40d46064d7d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 342KB
Sample260804-d34w5scd35
SHA256 333291bcc15576732423c3f872be3462513621f96bc0baef1f86b4b8733d7c91
MD5 081da8f20cfd9eece797d40d46064d7d
SHA1 86eec1a1e5ff0b84815554c54166fc4eb1df5f5e
SHA512 ccec835cf2367f39a2007bf9f97d16b06ef3a0e15ce79041c72491356506d5b8d322dc3596dac0fb762aee07cc22b90575c377cd04fc602593f8f6fa259aa9f8
SSDEEP 3072:BaMXqe/2pSzAshZumIpNmCEit9bgMF8xdoNi9EPvL+2sYJS/phdBZRP5zAt3b96n:p/sJB9n5T+2RJSnPL5oAG+B5OK
TLSH
T1A474494AFAA524F5D1BBC038C992251AFD713CA6437067CB63914A972F23BE4AD3D701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_081da8f20cfd9eece797d40d46064d7d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-03_081da8f20cfd9eece797d40d46064d7d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 342KB

2026-08-03_081da8f20cfd9eece797d40d46064d7d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH db7d3a21ac4f1854b6546f39816dafeb
SHA256 333291bcc15576732423c3f872be3462513621f96bc0baef1f86b4b8733d7c91
MD5 081da8f20cfd9eece797d40d46064d7d
SHA1 86eec1a1e5ff0b84815554c54166fc4eb1df5f5e
SHA512 ccec835cf2367f39a2007bf9f97d16b06ef3a0e15ce79041c72491356506d5b8d322dc3596dac0fb762aee07cc22b90575c377cd04fc602593f8f6fa259aa9f8
SSDEEP 3072:BaMXqe/2pSzAshZumIpNmCEit9bgMF8xdoNi9EPvL+2sYJS/phdBZRP5zAt3b96n:p/sJB9n5T+2RJSnPL5oAG+B5OK
TLSH
T1A474494AFAA524F5D1BBC038C992251AFD713CA6437067CB63914A972F23BE4AD3D701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

94868

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpSendRequest WinHttpOpenRequest WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen

gdi32

CreateCompatibleDC SetTextColor SetBkMode SelectObject GetDIBits DeleteObject DeleteDC BitBlt CreateCompatibleBitmap CreateFontW CreateSolidBrush

user32

ExitWindowsEx FillRect SetCursorPos ReleaseDC GetDC DrawTextA GetSystemMetrics SendInput VkKeyScanA ShowWindow

kernel32

SetStdHandle HeapSize CreateFileW WriteConsoleW SetEndOfFile GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose FindFirstFileA FindNextFileA Sleep GetConsoleWindow QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx RtlUnwind GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CloseHandle DuplicateHandle GetCurrentProcess CreateProcessW IsProcessorFeaturePresent ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetModuleFileNameW GetStdHandle WriteFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW WaitForSingleObject GetExitCodeProcess GetFileAttributesExW CreatePipe HeapReAlloc

Name

.text

Size

236KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_081da8f20cfd9eece797d40d46064d7d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

winhttp

gdi32

user32

kernel32

generic