2026-08-04_29705694e1ae36e26d3268a6029bfa49_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

General

Target
2026-08-04_29705694e1ae36e26d3268a6029bfa49_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 1.3MB
Sample260804-js8egavblf
SHA256 2517a6715b61266ab9cc503e76372a605411e8c28cda879345b4c781b5bb3d5b
MD5 29705694e1ae36e26d3268a6029bfa49
SHA1 31c4e18790aa4ebbc1e90f9ed2203c028c192731
SHA512 928d3c300ffa55050271759369456900816ed5c9da4c6438aeb4d90d69cead32fb475b36317e9af9cf100424650bb6e1b49e3df6c051dbbde3f659285aff048f
SSDEEP 24576:gLLmS7VTJbtJLi4mlmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:bmTJ7mob5+Pl6bJTIZ5jdgp
TLSH
T165559E60660909FCEAF1B638DBCE5311D3B13D52027795CF13D47F8A3A33A52AE6A251
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_29705694e1ae36e26d3268a6029bfa49_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-04_29705694e1ae36e26d3268a6029bfa49_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 1.3MB

2026-08-04_29705694e1ae36e26d3268a6029bfa49_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 6d4617f27a5c1346e12b4aa143ce3b95
SHA256 2517a6715b61266ab9cc503e76372a605411e8c28cda879345b4c781b5bb3d5b
MD5 29705694e1ae36e26d3268a6029bfa49
SHA1 31c4e18790aa4ebbc1e90f9ed2203c028c192731
SHA512 928d3c300ffa55050271759369456900816ed5c9da4c6438aeb4d90d69cead32fb475b36317e9af9cf100424650bb6e1b49e3df6c051dbbde3f659285aff048f
SSDEEP 24576:gLLmS7VTJbtJLi4mlmb57GBiOl6a8JTth/RWZvR6wQQ92pN3:bmTJ7mob5+Pl6bJTIZ5jdgp
TLSH
T165559E60660909FCEAF1B638DBCE5311D3B13D52027795CF13D47F8A3A33A52AE6A251
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

179212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\steam_rel_client_hotfix_win64\build\src\drivers\win32\steamxboxutil\win64\Release\steamxboxutil64.pdb

kernel32

LoadLibraryW LocalAlloc LocalFree lstrlenW GetProcAddress CloseHandle DeviceIoControl GetOverlappedResult CreateEventA WriteConsoleW FreeLibrary SetLastError CreateFileW GetLastError HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation WideCharToMultiByte MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetLocaleInfoEx GetStringTypeW CompareStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW

ole32

CoUninitialize CoCreateInstance CoInitialize

setupapi

CM_Get_DevNode_Status SetupDiSetClassInstallParamsW SetupDiSetDeviceRegistryPropertyW SetupDiGetDeviceRegistryPropertyW SetupDiOpenClassRegKey SetupDiCallClassInstaller SetupDiGetClassDevsW SetupCopyOEMInfW SetupDiGetDriverInfoDetailW SetupDiEnumDriverInfoW SetupDiBuildDriverInfoList SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiCreateDeviceInfoW SetupDiCreateDeviceInfoList SetupDiDestroyDriverInfoList

Name

.text

Size

327KB

Virtual Size

327KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

294KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_29705694e1ae36e26d3268a6029bfa49_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

kernel32

advapi32

ole32

setupapi

generic