2026-08-08_031812fe66b9ad50edc82c8d97042e17_cobalt-strike_icedid_luca-stealer_njrat_satacom

General

Target
2026-08-08_031812fe66b9ad50edc82c8d97042e17_cobalt-strike_icedid_luca-stealer_njrat_satacom
Size 1.3MB
Sample260808-r8vsbayfph
SHA256 c80c6901a9ab5b17202127690f0bfec3b62e6204f5cd831a4d898ac83d739568
MD5 031812fe66b9ad50edc82c8d97042e17
SHA1 596245f58fd0766f3ecdf9a5f877869d17de8030
SHA512 212df19bdee922d0802d138849b261f67848ca34bf56d25d99690473b2c1496afebda51d8be0047255f10b7ff6b23ade65969ff213d7d33a2d98c6e2e625d9c4
SSDEEP 24576:KIOrbFDCnrSgG44sydJmjT4dwIoeYb3oy9mGql7c1rsYExcJ3/UZtDnqh+LhFpWo:vOr0nhG44syv9irq2r3fM
TLSH
T10155AF83F292C0E9D61A8538CB556576A732BC58073076EB229C7A393E63FD05E3D316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_031812fe66b9ad50edc82c8d97042e17_cobalt-strike_icedid_luca-stealer_njrat_satacom

File Explorer

2026-08-08_031812fe66b9ad50edc82c8d97042e17_cobalt-strike_icedid_luca-stealer_njrat_satacom

.exe 1.3MB

2026-08-08_031812fe66b9ad50edc82c8d97042e17_cobalt-strike_icedid_luca-stealer_njrat_satacom

IMPHASH 9dff36945ef078b56685666dc0402444
SHA256 c80c6901a9ab5b17202127690f0bfec3b62e6204f5cd831a4d898ac83d739568
MD5 031812fe66b9ad50edc82c8d97042e17
SHA1 596245f58fd0766f3ecdf9a5f877869d17de8030
SHA512 212df19bdee922d0802d138849b261f67848ca34bf56d25d99690473b2c1496afebda51d8be0047255f10b7ff6b23ade65969ff213d7d33a2d98c6e2e625d9c4
SSDEEP 24576:KIOrbFDCnrSgG44sydJmjT4dwIoeYb3oy9mGql7c1rsYExcJ3/UZtDnqh+LhFpWo:vOr0nhG44syv9irq2r3fM
TLSH
T10155AF83F292C0E9D61A8538CB556576A732BC58073076EB229C7A393E63FD05E3D316
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

518720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

kernel32

Sleep SetFilePointerEx GetFileSizeEx HeapSize GetProcessHeap HeapFree CloseHandle GetSystemInfo HeapReAlloc AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread FlsAlloc GetModuleHandleExW GetModuleHandleW FlsFree FlsSetValue GetLastError GetStdHandle GetConsoleMode GetConsoleOutputCP GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte lstrlenW FormatMessageW WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc IsThreadAFiber GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter GetModuleHandleA GetFullPathNameW FindFirstFileExW FindClose CreateFileW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW GetModuleFileNameW CreateWaitableTimerExW SetWaitableTimer FlushFileBuffers GetStringTypeW SetStdHandle SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx FlsGetValue EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RaiseException RtlPcToFileHeader GetFileType ExitProcess TerminateProcess FreeLibrary WriteFile GetCommandLineA GetCommandLineW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter OutputDebugStringW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile

Name

.text

Size

605KB

Virtual Size

605KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

620KB

Virtual Size

619KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_031812fe66b9ad50edc82c8d97042e17_cobalt-strike_icedid_luca-stealer_njrat_satacom

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

generic