2026-08-08_3430d44ebbc25e0a44187a4c82b66ced_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

General

Target
2026-08-08_3430d44ebbc25e0a44187a4c82b66ced_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 336KB
Sample260808-eebfcszcma
SHA256 03739fed7be9a4b5c836e042fa3fac8187b1e78b08b9f6199a3099761333cd6c
MD5 3430d44ebbc25e0a44187a4c82b66ced
SHA1 076c760af627746ecf207c405fce6a2858d23137
SHA512 2b2b32b45365e1f39230ccc06bbfece48e4c7fd5e9ab41972bbdbde7b4e97a6b168c4fd6595d6b372b0f6e30d6386a1338e0a99b40eac713e1e7a93d27a3ea06
SSDEEP 3072:QHIdN2gNoKAP8VtSr0kYUYMlYSwdgjESRtnk78ZYYWSPKmdRBHbl0ljpPo0R1WjO:QGHUT2wk78KYtR/VoycMK
TLSH
T143743A1AFBA514F5D5BBC038C982251AF9717CA64770ABCB67904A5B2F237E0AD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_3430d44ebbc25e0a44187a4c82b66ced_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-08_3430d44ebbc25e0a44187a4c82b66ced_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 336KB

2026-08-08_3430d44ebbc25e0a44187a4c82b66ced_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 41fe4480f40b27043c0c49618c18ef16
SHA256 03739fed7be9a4b5c836e042fa3fac8187b1e78b08b9f6199a3099761333cd6c
MD5 3430d44ebbc25e0a44187a4c82b66ced
SHA1 076c760af627746ecf207c405fce6a2858d23137
SHA512 2b2b32b45365e1f39230ccc06bbfece48e4c7fd5e9ab41972bbdbde7b4e97a6b168c4fd6595d6b372b0f6e30d6386a1338e0a99b40eac713e1e7a93d27a3ea06
SSDEEP 3072:QHIdN2gNoKAP8VtSr0kYUYMlYSwdgjESRtnk78ZYYWSPKmdRBHbl0ljpPo0R1WjO:QGHUT2wk78KYtR/VoycMK
TLSH
T143743A1AFBA514F5D5BBC038C982251AF9717CA64770ABCB67904A5B2F237E0AD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

89524

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpSendRequest WinHttpOpenRequest WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen

gdi32

CreateFontW SetTextColor SetStretchBltMode StretchBlt SetBkMode SelectObject GetDIBits BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC CreateSolidBrush DeleteObject

user32

ExitWindowsEx FillRect SetCursorPos ReleaseDC GetDC DrawTextA GetSystemMetrics SendInput VkKeyScanA ShowWindow

kernel32

SetStdHandle HeapSize CreateFileW WriteConsoleW SetEndOfFile GetLastError GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose FindFirstFileA FindNextFileA Sleep GetComputerNameA GetConsoleWindow QueryPerformanceCounter QueryPerformanceFrequency WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx RtlUnwind SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CloseHandle DuplicateHandle GetCurrentProcess CreateProcessW IsProcessorFeaturePresent ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetModuleFileNameW GetStdHandle WriteFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW WaitForSingleObject GetExitCodeProcess GetFileAttributesExW CreatePipe HeapReAlloc

Name

.text

Size

231KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_3430d44ebbc25e0a44187a4c82b66ced_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

winhttp

gdi32

user32

kernel32

generic