2026-08-08_5287ea2d6e67358b4abf87ae9187bf8b_cobalt-strike_icedid_luca-stealer_njrat_satacom

General

Target
2026-08-08_5287ea2d6e67358b4abf87ae9187bf8b_cobalt-strike_icedid_luca-stealer_njrat_satacom
Size 1.3MB
Sample260808-ryc5hsdh93
SHA256 8a7c6065b6e3bf7ab742a92a19869a4f5bdea74af20e2234ca8da4b91ef02050
MD5 5287ea2d6e67358b4abf87ae9187bf8b
SHA1 8fcad6e023d78c093567af2e6d53fce4b45c9d24
SHA512 85921191b09d5b4559ce423c7cfad43daa453c00650d8c25486e7a30fcf5d9b2a1046fd9cab61c5e7c38f3cd2fc0adf08f1fcf27b39e1860fdfac9afe9f1d7f1
SSDEEP 24576:PxWFIYDDeY8/q0KItviVJIKUnCJ+sJzrRIIxuJu7IyorqHvPe7EgvnFt:5WFIDYt0KItvAFJvWIxuJ5rIUvF
TLSH
T19855AE43F2A6C0F9D62AC139DA651636A6337C58073567EB138C76293E23FD05E2E316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_5287ea2d6e67358b4abf87ae9187bf8b_cobalt-strike_icedid_luca-stealer_njrat_satacom

File Explorer

2026-08-08_5287ea2d6e67358b4abf87ae9187bf8b_cobalt-strike_icedid_luca-stealer_njrat_satacom

.exe 1.3MB

2026-08-08_5287ea2d6e67358b4abf87ae9187bf8b_cobalt-strike_icedid_luca-stealer_njrat_satacom

IMPHASH e3fa7c51d4164535ac974548901630e7
SHA256 8a7c6065b6e3bf7ab742a92a19869a4f5bdea74af20e2234ca8da4b91ef02050
MD5 5287ea2d6e67358b4abf87ae9187bf8b
SHA1 8fcad6e023d78c093567af2e6d53fce4b45c9d24
SHA512 85921191b09d5b4559ce423c7cfad43daa453c00650d8c25486e7a30fcf5d9b2a1046fd9cab61c5e7c38f3cd2fc0adf08f1fcf27b39e1860fdfac9afe9f1d7f1
SSDEEP 24576:PxWFIYDDeY8/q0KItviVJIKUnCJ+sJzrRIIxuJu7IyorqHvPe7EgvnFt:5WFIDYt0KItvAFJvWIxuJ5rIUvF
TLSH
T19855AE43F2A6C0F9D62AC139DA651636A6337C58073567EB138C76293E23FD05E2E316
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

517920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

kernel32

FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap HeapFree CloseHandle HeapReAlloc AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread FlsAlloc GetModuleHandleExW GetModuleHandleW FlsFree FlsSetValue GetLastError GetStdHandle GetConsoleMode GetConsoleOutputCP GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext GetCurrentProcess RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte lstrlenW FormatMessageW WaitForSingleObject MultiByteToWideChar WriteConsoleW HeapAlloc IsThreadAFiber GetEnvironmentVariableW GetModuleHandleA GetFullPathNameW FindFirstFileExW FindClose CreateFileW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW GetModuleFileNameW HeapSize SetFilePointerEx GetFileSizeEx SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx FlsGetValue EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RaiseException RtlPcToFileHeader GetFileType ExitProcess TerminateProcess FreeLibrary WriteFile GetCommandLineA GetCommandLineW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter OutputDebugStringW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW VirtualProtect LoadLibraryExW CompareStringW LCMapStringW

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile

Name

.text

Size

604KB

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

619KB

Virtual Size

619KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_5287ea2d6e67358b4abf87ae9187bf8b_cobalt-strike_icedid_luca-stealer_njrat_satacom

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

generic