2026-08-03_775d848dee8a9d789cb28d6a533c65be_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_775d848dee8a9d789cb28d6a533c65be_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 662KB
Sample260804-nc7v8adm3x
SHA256 6ef2a6e6c5609ac184b16b124e2d7ee303b9f7f55ff6deb4346a038312afe429
MD5 775d848dee8a9d789cb28d6a533c65be
SHA1 21cd47ab50a57c74247741618e963d0a06e2c840
SHA512 ce52c11c494450d85f43626095b665597caaadcac7151665fc49fc1fe04d9e612cf58db2ed37069bd7930f2ab6331047667b9a90303f54fc24ac7278b20693d4
SSDEEP 12288:p49/841WXeDQOFubymtrXJV6rpcwhUGuse:6mmLubjJVYTe
TLSH
T172E47D43D250C079C27FD17EC5A29921CDE3B8090369DDCB2BD4D85A0BAAB945F37B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-03_775d848dee8a9d789cb28d6a533c65be_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-03_775d848dee8a9d789cb28d6a533c65be_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 662KB

2026-08-03_775d848dee8a9d789cb28d6a533c65be_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 2f7d03f7c45304b8d27f593ef2ddbff5
SHA256 6ef2a6e6c5609ac184b16b124e2d7ee303b9f7f55ff6deb4346a038312afe429
MD5 775d848dee8a9d789cb28d6a533c65be
SHA1 21cd47ab50a57c74247741618e963d0a06e2c840
SHA512 ce52c11c494450d85f43626095b665597caaadcac7151665fc49fc1fe04d9e612cf58db2ed37069bd7930f2ab6331047667b9a90303f54fc24ac7278b20693d4
SSDEEP 12288:p49/841WXeDQOFubymtrXJV6rpcwhUGuse:6mmLubjJVYTe
TLSH
T172E47D43D250C079C27FD17EC5A29921CDE3B8090369DDCB2BD4D85A0BAAB945F37B62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

eb:77:85:19:7d:8d:6c:ce:4b:73:4a:21:3e:ba:54:74:47:04:cc:85:f6:40:2c:65:e8:5c:21:7f:9d:8f:f6:aa

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 10, 2025

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 19, 2025 - Jun 17, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:08:78:9d:58:5d:92:c7:d9:52:00:01:00:00:02:08

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

313656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage DispatchMessageA DefWindowProcA PostQuitMessage RegisterClassExA CreateWindowExA DestroyWindow GetSystemMetrics GetCursorPos GetMessageA

advapi32

RegOpenKeyExA RegEnumKeyExA RegCloseKey FreeSid CheckTokenMembership AllocateAndInitializeSid RegQueryValueExA

gdiplus

GdipCloneImage GdipAlloc GdiplusStartup GdiplusShutdown GdipDisposeImage GdipSaveImageToStream GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipGetImageEncoders GdipFree

ole32

GetHGlobalFromStream CreateStreamOnHGlobal

kernel32

SetStdHandle GetProcessHeap FreeEnvironmentStringsW HeapReAlloc HeapSize CreateFileW WriteConsoleW SetEndOfFile GetModuleHandleW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetEnvironmentVariableA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetDiskFreeSpaceExA GetFileAttributesA GetFileSize GetLogicalDrives ReadFile GetTempPathA GetVolumeInformationA CloseHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency Sleep ExitProcess TerminateProcess OpenProcess GlobalMemoryStatusEx GetSystemInfo GetLocalTime GetTickCount GetSystemDirectoryW GetWindowsDirectoryW VirtualAlloc VirtualProtect VirtualFree GetModuleFileNameW GetModuleHandleA LoadLibraryA GlobalSize GlobalUnlock GlobalLock LocalFree CopyFileA GetTimeZoneInformation GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwind WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo FlushFileBuffers RtlPcToFileHeader RaiseException RtlUnwindEx RtlLookupFunctionEntry SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetStdHandle WriteFile GetCurrentProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType

Name

.text

Size

451KB

Virtual Size

450KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_775d848dee8a9d789cb28d6a533c65be_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

PE Signature issue

user32

advapi32

gdiplus

ole32

kernel32

generic