2026-08-15_ae6c9d7e848cad79b0de0f1667fad94b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

General

Target
2026-08-15_ae6c9d7e848cad79b0de0f1667fad94b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 1.3MB
Sample260815-wbr3da1bpd
SHA256 189b3326a6d7e1b71706c1040b14019283316bacaa72d8a2d01431d43126ee95
MD5 ae6c9d7e848cad79b0de0f1667fad94b
SHA1 c465db1d0a5df57ba3304c41900c6aa8f2a41534
SHA512 82929f09460df2741684b361260b37e64eecd2b751efce7414ed9d44831dcd04143099bb8fbe85d1e69bb2f6b9c8ec022a5b15f79798947f8f4685afbe282ad4
SSDEEP 24576:tLLmS7VTJbtJLiamdM3tBZPzwFa7/wOifnz20:ImTJpmd4ZPzwFI/wOifnzH
TLSH
T1CE559E6066050AFCEBF1B638DBCA5311D3A13C55023795CF13E07F9A3E37A52AE6A251
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_ae6c9d7e848cad79b0de0f1667fad94b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-15_ae6c9d7e848cad79b0de0f1667fad94b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 1.3MB

2026-08-15_ae6c9d7e848cad79b0de0f1667fad94b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 6d4617f27a5c1346e12b4aa143ce3b95
SHA256 189b3326a6d7e1b71706c1040b14019283316bacaa72d8a2d01431d43126ee95
MD5 ae6c9d7e848cad79b0de0f1667fad94b
SHA1 c465db1d0a5df57ba3304c41900c6aa8f2a41534
SHA512 82929f09460df2741684b361260b37e64eecd2b751efce7414ed9d44831dcd04143099bb8fbe85d1e69bb2f6b9c8ec022a5b15f79798947f8f4685afbe282ad4
SSDEEP 24576:tLLmS7VTJbtJLiamdM3tBZPzwFa7/wOifnz20:ImTJpmd4ZPzwFI/wOifnzH
TLSH
T1CE559E6066050AFCEBF1B638DBCA5311D3A13C55023795CF13E07F9A3E37A52AE6A251
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

179212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\steam_rel_client_hotfix_win64\build\src\drivers\win32\steamxboxutil\win64\Release\steamxboxutil64.pdb

kernel32

LoadLibraryW LocalAlloc LocalFree lstrlenW GetProcAddress CloseHandle DeviceIoControl GetOverlappedResult CreateEventA WriteConsoleW FreeLibrary SetLastError CreateFileW GetLastError HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation WideCharToMultiByte MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetLocaleInfoEx GetStringTypeW CompareStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW

ole32

CoUninitialize CoCreateInstance CoInitialize

setupapi

CM_Get_DevNode_Status SetupDiSetClassInstallParamsW SetupDiSetDeviceRegistryPropertyW SetupDiGetDeviceRegistryPropertyW SetupDiOpenClassRegKey SetupDiCallClassInstaller SetupDiGetClassDevsW SetupCopyOEMInfW SetupDiGetDriverInfoDetailW SetupDiEnumDriverInfoW SetupDiBuildDriverInfoList SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiCreateDeviceInfoW SetupDiCreateDeviceInfoList SetupDiDestroyDriverInfoList

Name

.text

Size

327KB

Virtual Size

327KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

294KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_ae6c9d7e848cad79b0de0f1667fad94b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

kernel32

advapi32

ole32

setupapi

generic