2026-08-19_036661604dac85c7e2d8880303264b33_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_036661604dac85c7e2d8880303264b33_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 758KB
Sample260820-cftl8ayaje
SHA256 0ad166e2b93b5a9b3e986c02ce8874df903666eccb0e499e72cbd033d7e8b660
MD5 036661604dac85c7e2d8880303264b33
SHA1 c4768e8c2fc9e7c07870c4931a02dca448989aff
SHA512 aa387c9297d3f316d142c9db33ea051d1c4dc4338192c9a18f8b6ba969d5b336fb4a42f31bb9ca186be7926ec71146e4662fddb16e441f4f28433f52c3d5a248
SSDEEP 12288:KHDs+Wl99fo7Xtw/nv0TwNGPGf/Hoh8585XlvboXiCWnDoRf:KHDs+Wpfo7G0TwNGPIHoh8587Oi1nDe
TLSH
T123F4AE95B6F845F8E0779139C596B61BFA763808072095DB23E4066D2FB33E41BBB312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_036661604dac85c7e2d8880303264b33_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-19_036661604dac85c7e2d8880303264b33_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 758KB

2026-08-19_036661604dac85c7e2d8880303264b33_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 0d11ea08da21b77ba78cc8d22a538f2d
SHA256 0ad166e2b93b5a9b3e986c02ce8874df903666eccb0e499e72cbd033d7e8b660
MD5 036661604dac85c7e2d8880303264b33
SHA1 c4768e8c2fc9e7c07870c4931a02dca448989aff
SHA512 aa387c9297d3f316d142c9db33ea051d1c4dc4338192c9a18f8b6ba969d5b336fb4a42f31bb9ca186be7926ec71146e4662fddb16e441f4f28433f52c3d5a248
SSDEEP 12288:KHDs+Wl99fo7Xtw/nv0TwNGPGf/Hoh8585XlvboXiCWnDoRf:KHDs+Wpfo7G0TwNGPIHoh8587Oi1nDe
TLSH
T123F4AE95B6F845F8E0779139C596B61BFA763808072095DB23E4066D2FB33E41BBB312
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

413288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\baosa\Desktop\gay skid externals 2026\bin\x64\Release\GaySkidExternal.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GetModuleHandleA GetProcAddress CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW GetModuleFileNameA GetTickCount GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA IsDBCSLeadByte SetEndOfFile HeapReAlloc HeapSize CreateFileW GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP WriteProcessMemory IsValidCodePage WriteConsoleW FindFirstFileExW FindClose GetTimeZoneInformation GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType LCMapStringW CompareStringW LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle GetModuleFileNameW TerminateProcess ReadProcessMemory VirtualFree VirtualAlloc OpenProcess CloseHandle ExitProcess GetCurrentProcess SetConsoleTitleA AllocConsole Sleep GetACP OutputDebugStringA IsProcessorFeaturePresent ReadFile GetModuleHandleExW FreeLibraryAndExitThread FindNextFileW GetSystemTimePreciseAsFileTime GetLastError GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CreateThread ExitThread

user32

DispatchMessageW TranslateMessage GetWindowLongPtrW GetAsyncKeyState ClientToScreen SetCursor SetCursorPos GetClientRect GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SetWindowLongPtrW MessageBoxW SendInput ScreenToClient GetCursorPos LoadCursorW GetWindow GetClassNameW EnumWindows FindWindowW GetWindowRect GetWindowTextW SetWindowTextW IsWindowVisible SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW wsprintfW PeekMessageW

gdi32

CreateSolidBrush

shell32

ShellExecuteW

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

d3dcompiler_47

D3DCompile

Name

.text

Size

567KB

Virtual Size

566KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

155KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_036661604dac85c7e2d8880303264b33_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

d3d11

kernel32

user32

gdi32

shell32

imm32

d3dcompiler_47

generic