2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 365KB
Sample260804-fxbdragl3v
SHA256 8c9f001753929590128ab112232a85bdc4c1d74bbc621eced194f14268788b4d
MD5 dbcbccbd0201abcf7572c5c49d34c537
SHA1 474e09157262994297a18353e1c9b7ab034b1c82
SHA512 1a319e2d63d5c81ea1f84df75ea0d582716930dd3adf200b34914648188a4e403411460df3b42da9e57f4017fffe0483732f8e597382d0379f9c814724a6c518
SSDEEP 3072:lgGJ3v67Gie2MN/ZMu8XsfPqgFu9f8yssmJkC2863kachDFzy1i6QR1qz0O0Gawn:4cDsmJkC2863kaQD6dzIGaz3Ii336
TLSH
T1A4845C4AEBA510F5E5BBC178C952561BFD717CA24370A78F63904A972F23BA0AD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 365KB

2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH a9cc4fe37404a12c4b449a8726d8a804
SHA256 8c9f001753929590128ab112232a85bdc4c1d74bbc621eced194f14268788b4d
MD5 dbcbccbd0201abcf7572c5c49d34c537
SHA1 474e09157262994297a18353e1c9b7ab034b1c82
SHA512 1a319e2d63d5c81ea1f84df75ea0d582716930dd3adf200b34914648188a4e403411460df3b42da9e57f4017fffe0483732f8e597382d0379f9c814724a6c518
SSDEEP 3072:lgGJ3v67Gie2MN/ZMu8XsfPqgFu9f8yssmJkC2863kachDFzy1i6QR1qz0O0Gawn:4cDsmJkC2863kaQD6dzIGaz3Ii336
TLSH
T1A4845C4AEBA510F5E5BBC178C952561BFD717CA24370A78F63904A972F23BA0AD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

64896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLastError HeapAlloc HeapFree GetProcessHeap DeviceIoControl InitializeCriticalSectionEx DeleteCriticalSection WaitForSingleObject CreateEventW Sleep TerminateProcess CreateThread CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList CloseHandle GetSystemDirectoryW GetWindowsDirectoryW VirtualAlloc VirtualProtect VirtualFree GetModuleHandleW GetProcAddress LocalAlloc LocalFree CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteConsoleW HeapSize SetStdHandle DecodePointer DebugActiveProcessStop WaitForDebugEvent ContinueDebugEvent WriteFile SetFileAttributesW GetShortPathNameW GetFileAttributesW CreateFileW GetEnvironmentVariableW WideCharToMultiByte MultiByteToWideChar UpdateProcThreadAttribute GetCurrentProcess SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW RtlUnwind CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW GetFileType QueryPerformanceCounter GetSystemTimePreciseAsFileTime EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent OutputDebugStringW RaiseException RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent ExitProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW GetStdHandle RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter

advapi32

SetNamedSecurityInfoA GetNamedSecurityInfoA SetEntriesInAclW RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExA RegCreateKeyExW RegCloseKey FreeSid CreateWellKnownSid AllocateAndInitializeSid LookupPrivilegeValueW

ole32

CoInitializeSecurity CoUninitialize CoCreateInstance CoInitializeEx

oleaut32

SysFreeString SysAllocString SysAllocStringLen VariantInit VariantClear

shlwapi

PathCombineW

wininet

InternetCloseHandle InternetReadFile InternetOpenA InternetOpenUrlW InternetOpenUrlA InternetOpenW

rpcrt4

RpcBindingFromStringBindingW RpcStringBindingComposeW RpcStringFreeW RpcAsyncInitializeHandle RpcAsyncCompleteCall NdrAsyncClientCall NdrOleAllocate NdrOleFree RpcBindingFree RpcBindingSetAuthInfoExW

Name

.text

Size

213KB

Virtual Size

213KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

36KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_dbcbccbd0201abcf7572c5c49d34c537_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

kernel32

advapi32

ole32

oleaut32

shlwapi

wininet

rpcrt4

generic