2026-08-03_70a28ef572779609152e4dc036951a0e_cobalt-strike_icedid_luca-stealer_njrat_satacom

General

Target
2026-08-03_70a28ef572779609152e4dc036951a0e_cobalt-strike_icedid_luca-stealer_njrat_satacom
Size 148KB
Sample260804-dae3baeq5t
SHA256 61096f08bfdb6f84a9dc6869937c6cb3d729d823ba13cf02c4e98ce1110c1331
MD5 70a28ef572779609152e4dc036951a0e
SHA1 2abf08bf2f513b998b80687363662c2a3c7c04cc
SHA512 119a4d2b45d74586393b15bc1349ec379f114638881d12489bbc7a1130f6f6d95127ab1c69df165a014eff5cc29b448d8e695158a7ded2a659a6a21448cfd661
SSDEEP 3072:Ues5t1vhpLjDLRU3BbQCB8mV7RnMST+ux:+15pLjKBEQ8mV75+Q
TLSH
T107E35C4773A530F9E5B7823889A10A46E777B87103605BEF07A483756F232D1AD3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_70a28ef572779609152e4dc036951a0e_cobalt-strike_icedid_luca-stealer_njrat_satacom

File Explorer

2026-08-03_70a28ef572779609152e4dc036951a0e_cobalt-strike_icedid_luca-stealer_njrat_satacom

.exe 148KB

2026-08-03_70a28ef572779609152e4dc036951a0e_cobalt-strike_icedid_luca-stealer_njrat_satacom

IMPHASH f814159592b28dbc37e798144ced5684
SHA256 61096f08bfdb6f84a9dc6869937c6cb3d729d823ba13cf02c4e98ce1110c1331
MD5 70a28ef572779609152e4dc036951a0e
SHA1 2abf08bf2f513b998b80687363662c2a3c7c04cc
SHA512 119a4d2b45d74586393b15bc1349ec379f114638881d12489bbc7a1130f6f6d95127ab1c69df165a014eff5cc29b448d8e695158a7ded2a659a6a21448cfd661
SSDEEP 3072:Ues5t1vhpLjDLRU3BbQCB8mV7RnMST+ux:+15pLjKBEQ8mV75+Q
TLSH
T107E35C4773A530F9E5B7823889A10A46E777B87103605BEF07A483756F232D1AD3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

13164

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

connect freeaddrinfo getaddrinfo WSAGetLastError WSACleanup WSAStartup socket send recv ntohl htonl closesocket

advapi32

RegCreateKeyExW RegCloseKey GetUserNameA GetTokenInformation OpenProcessToken RegSetValueExW

kernel32

SetFilePointerEx HeapSize GetProcessHeap LCMapStringW CompareStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW FlsSetValue GetStdHandle GetEnvironmentVariableW SetCurrentDirectoryA GetCurrentDirectoryA CreateFileW DeleteFileW GetFileSize ReadFile SetFileAttributesW WriteFile GetTempPathW CloseHandle GetLastError CreatePipe CreateMutexW Sleep GetCurrentProcess GetCurrentProcessId ExitProcess CreateProcessA CreateProcessW GetSystemTime GetModuleFileNameW CopyFileW MoveFileW GetComputerNameA WriteConsoleA LoadLibraryExW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW VirtualProtect

shell32

SHGetFolderPathW

Name

.text

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_70a28ef572779609152e4dc036951a0e_cobalt-strike_icedid_luca-stealer_njrat_satacom

ws2_32

advapi32

kernel32

shell32

generic