2026-09-22_057a2939d2783856ceffcfb3cc9d9bf9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

General

Target
2026-09-22_057a2939d2783856ceffcfb3cc9d9bf9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 4.6MB
Sample260922-kl64hat19k
SHA256 735cc33cbb54f762fbc2c5945ce9505e6b08e275793f27f34171a5001f80fdae
MD5 057a2939d2783856ceffcfb3cc9d9bf9
SHA1 2b9ca4948f6f3989be3c3ffafef43de7ede5df88
SHA512 d7a2bdd43713730ee05312df0408b0ddcc426c8098d06d49d86d5e4907561375305d7ff33cf5ebdd524a0dee7822111a81c889a99d3faf7070274fc2814b318d
SSDEEP 98304:XQO7wZU6ftVZCjAvDaCTQMGCWLJzTITgrSvtmF3v1jCbG:XzwZ1tDCvNMGCWJOgr4ojCbG
TLSH
T1F5263330B26710FAF1F741B98921564FA773B8005720A5DF8B986683EE136E1CEBE745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-22_057a2939d2783856ceffcfb3cc9d9bf9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-09-22_057a2939d2783856ceffcfb3cc9d9bf9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 4.6MB

2026-09-22_057a2939d2783856ceffcfb3cc9d9bf9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH e3c39127b60a6c07a12ac34cc3e7193b
SHA256 735cc33cbb54f762fbc2c5945ce9505e6b08e275793f27f34171a5001f80fdae
MD5 057a2939d2783856ceffcfb3cc9d9bf9
SHA1 2b9ca4948f6f3989be3c3ffafef43de7ede5df88
SHA512 d7a2bdd43713730ee05312df0408b0ddcc426c8098d06d49d86d5e4907561375305d7ff33cf5ebdd524a0dee7822111a81c889a99d3faf7070274fc2814b318d
SSDEEP 98304:XQO7wZU6ftVZCjAvDaCTQMGCWLJzTITgrSvtmF3v1jCbG:XzwZ1tDCvNMGCWJOgr4ojCbG
TLSH
T1F5263330B26710FAF1F741B98921564FA773B8005720A5DF8B986683EE136E1CEBE745
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

35200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetDesktopWindow

shell32

SHGetSpecialFolderPathA

kernel32

CreateFileW CloseHandle GetCurrentProcess GetModuleHandleA GetProcAddress WriteConsoleW LockResource SizeofResource LoadLibraryA FindResourceA LoadResource IsDebuggerPresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetStdHandle WriteFile GetModuleFileNameW ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapFree HeapAlloc GetFileType VirtualProtect LoadLibraryExW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode

comctl32

ord17

Name

.text

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-22_057a2939d2783856ceffcfb3cc9d9bf9_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

user32

shell32

kernel32

comctl32

generic