2026-08-27_da579a10d57a0523dfa6d6298a25d31d_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_da579a10d57a0523dfa6d6298a25d31d_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 1.6MB
Sample260828-fd6esatbnd
SHA256 900c85f1a853e04c3ef54a6538144e528923c28cb4e61c3810093ac1ab6321ff
MD5 da579a10d57a0523dfa6d6298a25d31d
SHA1 1e2bec2a5f07e7045fdb1a769d9a4937ad13c4b8
SHA512 2fab27529d17880a18fce1829e67a9053ffa0af793adfc22a9ddbcca0300eef297362e862c0aaef0fc9d29a4cea0ffb3586e1e208adb4619d1d2cf792d5dbeb1
SSDEEP 24576:O8j2gscfljcTt6V4i1CLnkt6W2fLhloMu+vgjz6/LI9YQwfqHuB5bZD5kPKKftx:Jx94Tuv8LnkFuLhloMcvIGYjqOBNhGJ
TLSH
T1F585BF22EA9401FDD1BBD5F4CA269942E77278460330AEDF13D09A672F276D44B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_da579a10d57a0523dfa6d6298a25d31d_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-27_da579a10d57a0523dfa6d6298a25d31d_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 1.6MB

2026-08-27_da579a10d57a0523dfa6d6298a25d31d_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH f2a6bffbbefd7debe865e2fc070c744f
SHA256 900c85f1a853e04c3ef54a6538144e528923c28cb4e61c3810093ac1ab6321ff
MD5 da579a10d57a0523dfa6d6298a25d31d
SHA1 1e2bec2a5f07e7045fdb1a769d9a4937ad13c4b8
SHA512 2fab27529d17880a18fce1829e67a9053ffa0af793adfc22a9ddbcca0300eef297362e862c0aaef0fc9d29a4cea0ffb3586e1e208adb4619d1d2cf792d5dbeb1
SSDEEP 24576:O8j2gscfljcTt6V4i1CLnkt6W2fLhloMu+vgjz6/LI9YQwfqHuB5bZD5kPKKftx:Jx94Tuv8LnkFuLhloMcvIGYjqOBNhGJ
TLSH
T1F585BF22EA9401FDD1BBD5F4CA269942E77278460330AEDF13D09A672F276D44B3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

655824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

MultiByteToWideChar WideCharToMultiByte CreateDirectoryW GetTempPathW Sleep GetCurrentProcessId CreateFileMappingW MapViewOfFile UnmapViewOfFile DecodePointer HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryA ReadFile WaitNamedPipeW WritePrivateProfileStringW GetPrivateProfileStringW LoadResource LockResource SizeofResource FindResourceW GetFileAttributesW FreeLibrary LoadLibraryExW GetProcessTimes GetSystemTimeAsFileTime IsWow64Process GetWindowsDirectoryW GetFileSizeEx WaitForSingleObject ResumeThread QueryFullProcessImageNameW LocalFree SetEndOfFile WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetLastError CloseHandle WriteFile GetCurrentProcess CreateFileW GetCommandLineA FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread EncodePointer EnterCriticalSection LeaveCriticalSection CompareStringEx GetCPInfo LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead IsDebuggerPresent OutputDebugStringW RaiseException RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess TerminateProcess IsProcessorFeaturePresent GetStdHandle RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetFileType VirtualProtect RtlUnwind

user32

MessageBoxW MessageBoxA SetProcessDPIAware

advapi32

SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW ConvertStringSidToSidW

shell32

SHGetFolderPathW SHCreateDirectoryExW

ole32

CoUninitialize CoInitializeEx

oleaut32

SysAllocString SysFreeString SafeArrayCreate VariantInit SafeArrayUnaccessData SafeArrayAccessData

mscoree

CLRCreateInstance

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winmm

PlaySoundW

Name

.text

Size

827KB

Virtual Size

826KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

245KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

566KB

Virtual Size

565KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_da579a10d57a0523dfa6d6298a25d31d_amadey_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

ole32

oleaut32

mscoree

version

winmm

generic