2026-08-05_3b389dbad769da239e9bc2933c318b26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_3b389dbad769da239e9bc2933c318b26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 503KB
Sample260805-dpv23svsd1
SHA256 553955f78e3c59ad01a0be95b97e235ea5f63c88c97144d90ae23b0602cdda07
MD5 3b389dbad769da239e9bc2933c318b26
SHA1 5f9a5162ccf2a04f76f38ac8e122745879cca5d0
SHA512 faf3b0f266ac00942fb95aab22539b08be29aea4a10aec9de5493727d42b245e48f080dac9aa891e8d86447e640a5550ea676213bae8378327ff9ed9eeab2b95
SSDEEP 6144:2t9jiCW11SL01NBVMkoh71hBtAAhhnvBouw9U6lJClyi2a3FA9YbbahyeGgwbyu5:2t9jJW1dCkyTZsplJY2aVA9YQZ0Guse
TLSH
T1E9B48C25E76804BDE267827C8E574D02E676784A0331EADF03D49AB21F276D49E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-05_3b389dbad769da239e9bc2933c318b26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-05_3b389dbad769da239e9bc2933c318b26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 503KB

2026-08-05_3b389dbad769da239e9bc2933c318b26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 53826c352ca70d0aa21b9e35e78a1d57
SHA256 553955f78e3c59ad01a0be95b97e235ea5f63c88c97144d90ae23b0602cdda07
MD5 3b389dbad769da239e9bc2933c318b26
SHA1 5f9a5162ccf2a04f76f38ac8e122745879cca5d0
SHA512 faf3b0f266ac00942fb95aab22539b08be29aea4a10aec9de5493727d42b245e48f080dac9aa891e8d86447e640a5550ea676213bae8378327ff9ed9eeab2b95
SSDEEP 6144:2t9jiCW11SL01NBVMkoh71hBtAAhhnvBouw9U6lJClyi2a3FA9YbbahyeGgwbyu5:2t9jJW1dCkyTZsplJY2aVA9YQZ0Guse
TLSH
T1E9B48C25E76804BDE267827C8E574D02E676784A0331EADF03D49AB21F276D49E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

68:7e:49:11:2d:1d:85:33:18:06:36:a9:48:5e:3e:81:66:1e:c8:3a:32:4e:75:20:1a:2f:45:e1:9b:fc:90:0f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 10, 2025

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 19, 2025 - Jun 17, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:08:78:9d:58:5d:92:c7:d9:52:00:01:00:00:02:08

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

160312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetCursorPos GetSystemMetrics

advapi32

RegQueryValueExA RegOpenKeyExA AllocateAndInitializeSid CheckTokenMembership RegEnumKeyExA RegCloseKey FreeSid

gdiplus

GdipCloneImage GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipSaveImageToStream GdipAlloc GdipDisposeImage GdiplusShutdown GdiplusStartup GdipFree

ole32

CreateStreamOnHGlobal GetHGlobalFromStream

kernel32

SetEndOfFile LeaveCriticalSection WriteConsoleW CreateFileW HeapSize HeapReAlloc GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetEnvironmentVariableA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetDiskFreeSpaceExA GetFileAttributesA GetFileSize GetLogicalDrives ReadFile GetTempPathA GetVolumeInformationA CloseHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency Sleep ExitProcess TerminateProcess OpenProcess GlobalMemoryStatusEx GetSystemInfo GetLocalTime GetTickCount GetSystemDirectoryW GetWindowsDirectoryW VirtualAlloc VirtualProtect VirtualFree GetModuleFileNameW GetModuleHandleA LoadLibraryA GlobalSize GlobalUnlock GlobalLock LocalFree CopyFileA GetTimeZoneInformation GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW WideCharToMultiByte EnterCriticalSection RtlUnwind InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo FindNextFileW RtlPcToFileHeader RaiseException RtlUnwindEx RtlLookupFunctionEntry SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree GetStdHandle WriteFile GetCurrentProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW FindFirstFileExW

Name

.text

Size

301KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_3b389dbad769da239e9bc2933c318b26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

PE Signature issue

user32

advapi32

gdiplus

ole32

kernel32

generic