2026-09-21_f0661110ecfd09fa36d19717b0502543_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-21_f0661110ecfd09fa36d19717b0502543_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 363KB
Sample260922-k5439ace49
SHA256 4e50a6ebcb9234532c71567074c83dc843e0259f844da6a4df0a65afea7809fa
MD5 f0661110ecfd09fa36d19717b0502543
SHA1 0f77b270f33bd0ced45c5ff7081cbb5229ba1127
SHA512 9b80bb6412782fdad1736e1991bcf67017d26180ed67d39945b4dad24e3176681be975a81f35b01a720ccfc2050eda1f43890249864832536bb56d103ba830bc
SSDEEP 3072:8gnQ3YB7Gie2ZesJIo5O+mO/9B9GuKtPnip7mxxMM8zomhqllcBRz1i7hLL3HmCR:VYS7mxxMM8z3hOcRUUoz7pz3IibMC
TLSH
T1AE845B4AEBA520F5E5BBC038C952651BFD717C964770A78F63904A972F23BA0AD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-21_f0661110ecfd09fa36d19717b0502543_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-09-21_f0661110ecfd09fa36d19717b0502543_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 363KB

2026-09-21_f0661110ecfd09fa36d19717b0502543_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 24eb3a684098fbe2adaabc6a4d789f42
SHA256 4e50a6ebcb9234532c71567074c83dc843e0259f844da6a4df0a65afea7809fa
MD5 f0661110ecfd09fa36d19717b0502543
SHA1 0f77b270f33bd0ced45c5ff7081cbb5229ba1127
SHA512 9b80bb6412782fdad1736e1991bcf67017d26180ed67d39945b4dad24e3176681be975a81f35b01a720ccfc2050eda1f43890249864832536bb56d103ba830bc
SSDEEP 3072:8gnQ3YB7Gie2ZesJIo5O+mO/9B9GuKtPnip7mxxMM8zomhqllcBRz1i7hLL3HmCR:VYS7mxxMM8z3hOcRUUoz7pz3IibMC
TLSH
T1AE845B4AEBA520F5E5BBC038C952651BFD717C964770A78F63904A972F23BA0AD3D700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

75456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLastError HeapAlloc HeapFree GetProcessHeap DeviceIoControl InitializeCriticalSectionEx DeleteCriticalSection WaitForSingleObject Sleep GetCurrentProcessId TerminateProcess CreateThread CloseHandle GetWindowsDirectoryW VirtualAlloc VirtualProtect VirtualFree ReadProcessMemory GetModuleFileNameW GetModuleHandleW GetProcAddress LocalFree CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteConsoleW HeapSize SetStdHandle DecodePointer WriteFile SetFileAttributesW GetShortPathNameW GetFullPathNameW GetFileAttributesW CreateFileW GetEnvironmentVariableW WideCharToMultiByte MultiByteToWideChar OpenProcess GetCurrentProcess SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale RtlUnwind GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW GetFileType QueryPerformanceCounter GetSystemTimePreciseAsFileTime EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent OutputDebugStringW RaiseException RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent ExitProcess FreeLibrary GetModuleHandleExW GetStdHandle RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter

advapi32

SetNamedSecurityInfoA GetNamedSecurityInfoA SetEntriesInAclW RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExA RegCreateKeyExW RegCloseKey FreeSid AllocateAndInitializeSid LookupPrivilegeValueW

ole32

IIDFromString CoGetObject CoCreateInstance CoInitializeSecurity CoUninitialize CoInitializeEx

oleaut32

SysFreeString SysAllocString SysAllocStringLen VariantInit VariantClear

shlwapi

PathStripToRootW PathCombineW

wininet

InternetCloseHandle InternetOpenUrlA InternetOpenUrlW InternetOpenW InternetOpenA InternetReadFile

rpcrt4

NdrOleAllocate NdrOleFree

Name

.text

Size

224KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

85KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

36KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-21_f0661110ecfd09fa36d19717b0502543_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

kernel32

advapi32

ole32

oleaut32

shlwapi

wininet

rpcrt4

generic