2026-08-08_f625a59dcb9b04d54f3cdb2ce7a0d8a0_cobalt-strike_icedid_luca-stealer_njrat_satacom

General

Target
2026-08-08_f625a59dcb9b04d54f3cdb2ce7a0d8a0_cobalt-strike_icedid_luca-stealer_njrat_satacom
Size 1.3MB
Sample260808-rcpanassgv
SHA256 9595f3d833fa3082cdbf66ee1e6168a6b31b0a407fd67761ab750ee38d3dd4c7
MD5 f625a59dcb9b04d54f3cdb2ce7a0d8a0
SHA1 aefce89e84aa37148f6dded79e10c064da4e1ab9
SHA512 a096bd0e9be37f7c84978f5bb05f423e76d15611f0e29f60c50ad1af1051df94c36c6f90c7a16a89b93f06b20febd546ed740c233cc863b649a3a8aa1744aa66
SSDEEP 24576:higyOYtSJsQzKb55w20BljyNiqkMjAlw2rI/pEJ8d6zBe6:h8Ojs1b55wj8AWRpKA
TLSH
T14955AF83F262C0FDD12A8138CA655636AA327C58473467EB169C7B393E63FD05A3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_f625a59dcb9b04d54f3cdb2ce7a0d8a0_cobalt-strike_icedid_luca-stealer_njrat_satacom

File Explorer

2026-08-08_f625a59dcb9b04d54f3cdb2ce7a0d8a0_cobalt-strike_icedid_luca-stealer_njrat_satacom

.exe 1.3MB

2026-08-08_f625a59dcb9b04d54f3cdb2ce7a0d8a0_cobalt-strike_icedid_luca-stealer_njrat_satacom

IMPHASH e3fa7c51d4164535ac974548901630e7
SHA256 9595f3d833fa3082cdbf66ee1e6168a6b31b0a407fd67761ab750ee38d3dd4c7
MD5 f625a59dcb9b04d54f3cdb2ce7a0d8a0
SHA1 aefce89e84aa37148f6dded79e10c064da4e1ab9
SHA512 a096bd0e9be37f7c84978f5bb05f423e76d15611f0e29f60c50ad1af1051df94c36c6f90c7a16a89b93f06b20febd546ed740c233cc863b649a3a8aa1744aa66
SSDEEP 24576:higyOYtSJsQzKb55w20BljyNiqkMjAlw2rI/pEJ8d6zBe6:h8Ojs1b55wj8AWRpKA
TLSH
T14955AF83F262C0FDD12A8138CA655636AA327C58473467EB169C7B393E63FD05A3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

526736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

kernel32

FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap HeapFree CloseHandle HeapReAlloc AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread FlsAlloc GetModuleHandleExW GetModuleHandleW FlsFree FlsSetValue GetLastError GetStdHandle GetConsoleMode GetConsoleOutputCP GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte lstrlenW FormatMessageW WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc IsThreadAFiber GetEnvironmentVariableW GetModuleHandleA GetFullPathNameW FindFirstFileExW FindClose CreateFileW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW GetModuleFileNameW HeapSize SetFilePointerEx GetFileSizeEx SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx FlsGetValue EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RaiseException RtlPcToFileHeader GetFileType ExitProcess TerminateProcess FreeLibrary WriteFile GetCommandLineA GetCommandLineW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter OutputDebugStringW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile

Name

.text

Size

613KB

Virtual Size

612KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

619KB

Virtual Size

619KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_f625a59dcb9b04d54f3cdb2ce7a0d8a0_cobalt-strike_icedid_luca-stealer_njrat_satacom

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

generic