2026-08-04_3458e313f67339ae73bb00d5c02aff52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_3458e313f67339ae73bb00d5c02aff52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 7.1MB
Sample260804-jlsensfe47
SHA256 f30885f829421955155f49542e24703901b999e34b82877bfccfb6ac09312814
MD5 3458e313f67339ae73bb00d5c02aff52
SHA1 fe58728df2630d1f2ce7ce6e0b58fae907b3b2b6
SHA512 3df3d75283a11c63f6509417c4def04ce7dd1517b6bcf3396a9be974d293229e1c7b88d1ad6518b3ecb70c777fddbff0e8f2412f921a13d618fe7e10811cb3f6
SSDEEP 49152:ql8wjpJHr354wp50snawKvRrvcXiT4fRVT6nksdyqXpQWThgRo+8Q6xOmL2QaHkU:Xo6wp6NIVboBm2slHXxVnv24TF
TLSH
T1AE76AF16A3E801ACF0B7D675CA265913EA727CD91732E6DF0690641D1F33BE09E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects binaries and memory artifacts referencing sandbox product IDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxProductID

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Fody

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_3458e313f67339ae73bb00d5c02aff52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-04_3458e313f67339ae73bb00d5c02aff52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 7.1MB

2026-08-04_3458e313f67339ae73bb00d5c02aff52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 474556ccb3ead8d9447e2209fde812bf
SHA256 f30885f829421955155f49542e24703901b999e34b82877bfccfb6ac09312814
MD5 3458e313f67339ae73bb00d5c02aff52
SHA1 fe58728df2630d1f2ce7ce6e0b58fae907b3b2b6
SHA512 3df3d75283a11c63f6509417c4def04ce7dd1517b6bcf3396a9be974d293229e1c7b88d1ad6518b3ecb70c777fddbff0e8f2412f921a13d618fe7e10811cb3f6
SSDEEP 49152:ql8wjpJHr354wp50snawKvRrvcXiT4fRVT6nksdyqXpQWThgRo+8Q6xOmL2QaHkU:Xo6wp6NIVboBm2slHXxVnv24TF
TLSH
T1AE76AF16A3E801ACF0B7D675CA265913EA727CD91732E6DF0690641D1F33BE09E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects binaries and memory artifacts referencing sandbox product IDs
Detects executables manipulated with Fody
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1813640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpWebSocketCompleteUpgrade WinHttpWebSocketClose WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl WinHttpCloseHandle WinHttpQueryDataAvailable

crypt32

CryptStringToBinaryA CryptBinaryToStringA CryptUnprotectData

bcrypt

BCryptEncrypt BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt BCryptFinishHash BCryptDestroyHash BCryptHashData BCryptCreateHash

gdiplus

GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipSaveImageToStream GdipGetImageEncoders GdiplusShutdown GdiplusStartup GdipCreateBitmapFromScan0 GdipDeleteGraphics GdipGetImageGraphicsContext GdipCloneImage GdipGetImageEncodersSize GdipSetCompositingQuality GdipDrawImageRectI GdipSetPixelOffsetMode GdipSetInterpolationMode

kernel32

GetStdHandle IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FlsFree FlsSetValue RtlCaptureContext FlsAlloc SetLastError RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry FlsGetValue RtlVirtualUnwind IsDebuggerPresent GetLastError ExitProcess SetThreadAffinityMask GetSystemFirmwareTable GetPhysicallyInstalledSystemMemory TerminateProcess LocalAlloc GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW QueryPerformanceFrequency Process32FirstW CloseHandle GetNativeSystemInfo LocalFree GetModuleHandleW WideCharToMultiByte SleepEx BuildCommDCBAndTimeoutsA EnumSystemFirmwareTables QueryPerformanceCounter VirtualQuery GetComputerNameA SizeofResource GetModuleFileNameW EnumResourceNamesW SetFileAttributesW GetLogicalDriveStringsW EndUpdateResourceW LockResource LoadResource FindResourceW UpdateResourceW FreeLibrary BeginUpdateResourceW QueryFullProcessImageNameW GetDriveTypeW LoadLibraryExW ReadFile FindFirstFileW FindNextFileW WriteFile CreateNamedPipeW PeekNamedPipe GetTempPathW FindClose GetCurrentThreadId GetCurrentProcessId CreateProcessW GetTickCount ConnectNamedPipe FlushFileBuffers GetVolumeInformationW GetFileSizeEx UnhandledExceptionFilter CreateFileW DeleteFileW GlobalMemoryStatusEx GetFileAttributesExW GetSystemTime CreateMutexW GetVersionExW ExitThread GetTickCount64 GetFileSize SetUnhandledExceptionFilter GetTimeZoneInformation GetSystemInfo CreateDirectoryW QueryDosDeviceW GetCurrentProcess RemoveDirectoryW GetEnvironmentVariableW WaitForSingleObject MultiByteToWideChar TerminateThread CreateThread GetLocalTime CopyFileW GetFileAttributesW LoadLibraryW GetProcAddress SetDllDirectoryW GetLogicalDrives GetDriveTypeA CreatePipe SetErrorMode FileTimeToSystemTime SetFilePointerEx CreateProcessA GetDiskFreeSpaceExA AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx UnmapViewOfFile HeapValidate HeapSize GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA HeapReAlloc RaiseException HeapAlloc RtlUnwind HeapDestroy UnlockFile CreateFileMappingA LockFileEx DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile GetFileType LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW GetConsoleOutputCP GetConsoleMode VirtualProtect CompareStringW GetComputerNameW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW SetFilePointer HeapCompact

user32

GetSystemMetrics SendInput ReleaseDC GetDC EnumDisplayDevicesW

gdi32

CreateCompatibleBitmap DeleteObject GetDeviceCaps BitBlt CreateCompatibleDC SelectObject DeleteDC

advapi32

RegQueryValueExA OpenProcessToken RegOpenKeyExW RegGetValueW GetTokenInformation CryptAcquireContextW CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW RegQueryValueExW GetUserNameW RegSetValueExW CryptAcquireContextA RegEnumKeyExW

shell32

ShellExecuteExW

ole32

CoTaskMemFree CreateStreamOnHGlobal

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiOpenDevRegKey SetupDiGetDevicePropertyW

api-ms-win-core-realtime-l1-1-1

QueryInterruptTime

iphlpapi

GetAdaptersInfo

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW GetExitCodeThread

api-ms-win-core-sysinfo-l1-1-0

GetLogicalProcessorInformationEx

api-ms-win-core-file-l1-1-0

FindFirstFileExW SetFileInformationByHandle GetFinalPathNameByHandleW

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-localization-l1-2-0

GetCPInfo GetLocaleInfoEx LCMapStringEx

api-ms-win-core-synch-l1-1-0

TryAcquireSRWLockExclusive InitializeCriticalSectionEx ReleaseSRWLockExclusive AcquireSRWLockExclusive

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable SleepConditionVariableSRW

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-string-l1-1-0

GetStringTypeW CompareStringEx

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

wevtapi

EvtNext EvtClose EvtCreateRenderContext EvtQuery EvtRender

ntdll

RtlInitUnicodeString

d3d11

D3D11CreateDevice

mf

MFEnumDeviceSources

mfplat

MFStartup MFCreateAttributes MFCreateMediaType MFShutdown

mfreadwrite

MFCreateSourceReaderFromMediaSource

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_3458e313f67339ae73bb00d5c02aff52_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

winhttp

crypt32

bcrypt

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

setupapi

api-ms-win-core-realtime-l1-1-1

iphlpapi

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-interlocked-l1-1-0

wevtapi

ntdll

d3d11

mf

mfplat

mfreadwrite

generic