2026-08-10_8b0e82ac204fa70b73919125cdbe38c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_8b0e82ac204fa70b73919125cdbe38c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 6.6MB
Sample260810-a7sswsgl3w
SHA256 9f0980c36de431be8ad199c69c66df6b7c11bd103d91dade52010bfcc172cfab
MD5 8b0e82ac204fa70b73919125cdbe38c4
SHA1 1cbf351293ae84c0187edb0ed14dbea2d1e32017
SHA512 7609cf3e1fd0bb5d31cd03d54dea8ba427c38bdcea628e828a4d043834b3ae71f1ed0e878a550ae3a8b318c7def07fa486223344e86b8cca45f760e86eae22fa
SSDEEP 98304:3tmZBg/zffnJ9cRdS6o0vSbfYrfgXbhf:diB0nJSW6oMSMD8
TLSH
T1BA66BF16B6A7C0A8C367C579861659F3EAB17C4903319BDB16A0F5562F33AF01E3B720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects binaries and memory artifacts referencing sandbox product IDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxProductID

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_8b0e82ac204fa70b73919125cdbe38c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-10_8b0e82ac204fa70b73919125cdbe38c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 6.6MB

2026-08-10_8b0e82ac204fa70b73919125cdbe38c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH c0c416713cf829612e9ddfafc2ce78fa
SHA256 9f0980c36de431be8ad199c69c66df6b7c11bd103d91dade52010bfcc172cfab
MD5 8b0e82ac204fa70b73919125cdbe38c4
SHA1 1cbf351293ae84c0187edb0ed14dbea2d1e32017
SHA512 7609cf3e1fd0bb5d31cd03d54dea8ba427c38bdcea628e828a4d043834b3ae71f1ed0e878a550ae3a8b318c7def07fa486223344e86b8cca45f760e86eae22fa
SSDEEP 98304:3tmZBg/zffnJ9cRdS6o0vSbfYrfgXbhf:diB0nJSW6oMSMD8
TLSH
T1BA66BF16B6A7C0A8C367C579861659F3EAB17C4903319BDB16A0F5562F33AF01E3B720
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Detects binaries and memory artifacts referencing sandbox product IDs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1688616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpConnect WinHttpCrackUrl

crypt32

CryptBinaryToStringA CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptEncrypt BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptFinishHash BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptSetProperty

gdiplus

GdipSaveImageToStream GdiplusStartup GdipGetImageEncodersSize GdipFree GdipDisposeImage GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdipCreateBitmapFromHBITMAP

kernel32

UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread GetLastError SetThreadAffinityMask GetSystemFirmwareTable GetPhysicallyInstalledSystemMemory TerminateProcess LocalAlloc GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep Process32NextW QueryPerformanceFrequency Process32FirstW CloseHandle GetNativeSystemInfo LocalFree ExitProcess GetModuleHandleW WideCharToMultiByte SleepEx BuildCommDCBAndTimeoutsA EnumSystemFirmwareTables QueryPerformanceCounter VirtualQuery GetComputerNameA GetModuleFileNameA SizeofResource EnumResourceNamesW EndUpdateResourceW LockResource LoadResource FindResourceW SetFileAttributesA UpdateResourceW FreeLibrary BeginUpdateResourceW QueryFullProcessImageNameW LoadLibraryExW ReadFile FindFirstFileA WriteFile CreateNamedPipeW FindNextFileA PeekNamedPipe FindClose GetCurrentThreadId GetTempPathA GetCurrentProcessId CreateProcessW GetTickCount ConnectNamedPipe FlushFileBuffers GetSystemTime SetFilePointer GetVersionExW GetTickCount64 GetLocaleInfoW GetFileSize GetSystemInfo GlobalMemoryStatusEx FindFirstFileW FindNextFileW GetCurrentProcess RemoveDirectoryW WaitForSingleObject SetFileAttributesW MultiByteToWideChar CopyFileA DeleteFileW CreateThread GetLocalTime CreateDirectoryA AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW CreateFileW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile LoadLibraryA WaitForSingleObjectEx GetVersionExA DeleteFileA HeapReAlloc RaiseException LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress RtlUnwind LockFileEx DeleteCriticalSection GetProcessHeap SystemTimeToFileTime GetSystemTimeAsFileTime FormatMessageA CreateFileMappingW MapViewOfFile GetFileType GetFileSizeEx SetFilePointerEx GetConsoleOutputCP GetConsoleMode VirtualProtect CreateProcessA IsValidLocale GetUserDefaultLCID CompareStringW GetTimeZoneInformation LCMapStringW EnumSystemLocalesW ReadConsoleW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle WriteConsoleW CreateFileA CreateFileMappingA ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteDC DeleteObject GetDeviceCaps BitBlt

advapi32

CryptAcquireContextA RegSetValueExA RegOpenKeyExA GetUserNameA LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegQueryValueExA RegEnumKeyExW OpenProcessToken RegOpenKeyExW RegGetValueW GetTokenInformation CryptAcquireContextW CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext

setupapi

SetupDiDestroyDeviceInfoList SetupDiOpenDevRegKey SetupDiGetDevicePropertyW SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyA SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW

api-ms-win-core-realtime-l1-1-1

QueryInterruptTime

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW GetExitCodeThread

api-ms-win-core-sysinfo-l1-1-0

GetLogicalProcessorInformationEx

api-ms-win-core-file-l1-1-0

CreateDirectoryW SetFileInformationByHandle GetFinalPathNameByHandleW FindFirstFileExW

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-localization-l1-2-0

LCMapStringEx GetLocaleInfoEx GetCPInfo

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx ReleaseSRWLockExclusive TryAcquireSRWLockExclusive AcquireSRWLockExclusive

api-ms-win-core-sysinfo-l1-2-0

GetSystemTimePreciseAsFileTime

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable SleepConditionVariableSRW

api-ms-win-core-util-l1-1-0

EncodePointer DecodePointer

api-ms-win-core-string-l1-1-0

CompareStringEx GetStringTypeW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

wevtapi

EvtQuery EvtNext EvtRender EvtClose EvtCreateRenderContext

ntdll

RtlInitUnicodeString

Name

.text

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

257KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_8b0e82ac204fa70b73919125cdbe38c4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

winhttp

crypt32

bcrypt

gdiplus

kernel32

gdi32

advapi32

setupapi

api-ms-win-core-realtime-l1-1-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-interlocked-l1-1-0

wevtapi

ntdll

generic