2026-08-04_426cf7a1826c4ff3b9df3e435b496928_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_426cf7a1826c4ff3b9df3e435b496928_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 4.2MB
Sample260804-jdll6atgpf
SHA256 95ff6fe839294c20e1942de383a9f3b7619898b0b9d1bb5484b2b6b11f9db7df
MD5 426cf7a1826c4ff3b9df3e435b496928
SHA1 8f099115748d5c8fac8870fdb0e74b12c31ffe9e
SHA512 8a274c50357c5ef343230355baf7b41991dfcd82dde551f55e918c29957c9a5dbc4be202b5a48f8f65077371e85203b2183db390a72f8a6dada6f2a411ccc5a2
SSDEEP 98304:Qh83E5SzafZPfxIpPwHgIUadnSZazvskh8:Qh83E5oaZqEMwo
TLSH
T18426F13AF716484EC02F037B4992C3B5C5512B80FA3952F716B15E53BAE36C25EA6EC1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_426cf7a1826c4ff3b9df3e435b496928_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-04_426cf7a1826c4ff3b9df3e435b496928_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 4.2MB

2026-08-04_426cf7a1826c4ff3b9df3e435b496928_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH d2fb6b0b49e1a8420ec7bf809bf754e7
SHA256 95ff6fe839294c20e1942de383a9f3b7619898b0b9d1bb5484b2b6b11f9db7df
MD5 426cf7a1826c4ff3b9df3e435b496928
SHA1 8f099115748d5c8fac8870fdb0e74b12c31ffe9e
SHA512 8a274c50357c5ef343230355baf7b41991dfcd82dde551f55e918c29957c9a5dbc4be202b5a48f8f65077371e85203b2183db390a72f8a6dada6f2a411ccc5a2
SSDEEP 98304:Qh83E5SzafZPfxIpPwHgIUadnSZazvskh8:Qh83E5oaZqEMwo
TLSH
T18426F13AF716484EC02F037B4992C3B5C5512B80FA3952F716B15E53BAE36C25EA6EC1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

119692

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\me\Documents\GitHub\Malware-danger-imminent\Release\SF-Verif.pdb

kernel32

GetConsoleWindow GetTickCount AllocConsole GetComputerNameA WriteConsoleW SetEndOfFile GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP SetThreadExecutionState HeapSize ReadConsoleW ReadFile CreateProcessW GetExitCodeProcess WaitForSingleObject HeapReAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID GlobalMemoryStatusEx DeleteCriticalSection GetProcAddress SetCurrentDirectoryW DecodePointer CreateThread LoadLibraryW CloseHandle TerminateThread GetLastError Sleep CreateFileW GetCurrentThreadId InitializeCriticalSectionEx GetModuleFileNameW WriteFile GetStdHandle GetCurrentProcess SetConsoleTitleA IsValidCodePage SetConsoleTextAttribute IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA GetModuleHandleExW FreeLibrary ExitProcess TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent FlsFree FlsSetValue LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW SetFileInformationByHandle GetTempPathW CreateFile2 AreFileApisANSI GetModuleHandleW CopyFile2 GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte LCMapStringEx EnterCriticalSection LeaveCriticalSection EncodePointer CompareStringEx GetCPInfo GetStringTypeW IsDebuggerPresent OutputDebugStringW RaiseException QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader SetLastError FlsAlloc FlsGetValue RtlUnwind

user32

UnhookWindowsHookEx MessageBoxA SetWindowTextA DispatchMessageW ShowWindow GetShellWindow EnumWindows CallNextHookEx SetWindowPos IsWindowVisible GetDC GetWindowRect EnumDisplayDevicesA GetMessageW GetDesktopWindow GetWindowDC TranslateMessage GetSystemMetrics ReleaseDC InvalidateRect SetWindowsHookExW

gdi32

BitBlt CreateCompatibleBitmap CreateFontA SelectObject CreateDIBSection CreateCompatibleDC StretchBlt DeleteDC SetTextColor TextOutA SetBkMode DeleteObject

advapi32

AdjustTokenPrivileges RegCloseKey RegQueryValueExA GetUserNameA OpenProcessToken RegOpenKeyExA LookupPrivilegeValueW

ole32

CLSIDFromString CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

OleLoadPicturePath

winmm

mciSendStringA

wininet

InternetReadFile InternetConnectA HttpOpenRequestA InternetCrackUrlA InternetOpenUrlA InternetOpenA InternetCloseHandle HttpSendRequestA

gdiplus

GdipSaveImageToFile GdipFree GdipDisposeImage GdiplusStartup GdipAlloc GdipCloneImage GdiplusShutdown GdipCreateBitmapFromHBITMAP

Name

.text

Size

267KB

Virtual Size

266KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_426cf7a1826c4ff3b9df3e435b496928_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

kernel32

user32

gdi32

advapi32

ole32

oleaut32

winmm

wininet

gdiplus

generic