2026-09-28_6da755989c46486428db07f5a8fa4dce_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_6da755989c46486428db07f5a8fa4dce_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 4.8MB
Sample260928-sd2g2sxv2k
SHA256 648622d4049548e29503af88194a679ba24425139e6e54159d9c92026a42a00d
MD5 6da755989c46486428db07f5a8fa4dce
SHA1 79038f105f237eea911f9f04f3d9f05af50db4d0
SHA512 119ad27ffe279fc078a866fd5b5e0a829c648e267b10ac280d4a531cf7712d91e332f6d8da5a2bea2efb0994d3b2231523bb4ec6a394e4d0692317b871d9f35f
SSDEEP 98304:kmhpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+R1:3GpELcoR1
TLSH
T13F368CC6BE88F5E5C0A48834B906D57ED6737C6A8B11468732D7FB1F2A37180453B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_6da755989c46486428db07f5a8fa4dce_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-09-28_6da755989c46486428db07f5a8fa4dce_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 4.8MB

2026-09-28_6da755989c46486428db07f5a8fa4dce_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH a3392de8ea091e86e63be66d183a0183
SHA256 648622d4049548e29503af88194a679ba24425139e6e54159d9c92026a42a00d
MD5 6da755989c46486428db07f5a8fa4dce
SHA1 79038f105f237eea911f9f04f3d9f05af50db4d0
SHA512 119ad27ffe279fc078a866fd5b5e0a829c648e267b10ac280d4a531cf7712d91e332f6d8da5a2bea2efb0994d3b2231523bb4ec6a394e4d0692317b871d9f35f
SSDEEP 98304:kmhpwBP/OlsLzFmNfW6FJKxxfZA4AnyxpELRSKE+R1:3GpELcoR1
TLSH
T13F368CC6BE88F5E5C0A48834B906D57ED6737C6A8B11468732D7FB1F2A37180453B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4870144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetVolumePathNameW ReadFile RemoveDirectoryW SetFileAttributesW SetFileInformationByHandle SetFilePointer GetCompressedFileSizeW FindFirstFileNameW IsDebuggerPresent SetHandleInformation CreatePipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus DeviceIoControl SetEvent OpenMutexW CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait IsWow64Process GlobalAlloc GlobalUnlock GlobalLock GlobalFree ReadDirectoryChangesW CreateSymbolicLinkW CompareStringOrdinal WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessIoCounters GetPrivateProfileStringW WritePrivateProfileStringW CopyFileW MoveFileExW ReplaceFileW GetComputerNameW RegisterApplicationRestart GetFileInformationByHandleEx OpenFileById GetModuleHandleW GetDllDirectoryW MultiByteToWideChar WriteConsoleW ReadConsoleW SetEndOfFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileAttributesExW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindNextFileW FindFirstFileExW SetFilePointerEx GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetTimeFormatW GetDateFormatW GetFileAttributesW GetDiskFreeSpaceExW FindVolumeClose FindNextVolumeW FindFirstVolumeW CreateFileW CreateDirectoryW K32GetProcessMemoryInfo SetThreadInformation GetSystemTimes ProcessIdToSessionId SetProcessShutdownParameters GetExitCodeProcess GetProcessTimes WaitForMultipleObjects CreateEventW ReleaseMutex GetLongPathNameW SetLastError VerifyVersionInfoW GetProductInfo VerSetConditionMask ExpandEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW K32GetModuleFileNameExW GetUserDefaultLCID GetUserGeoID LCIDToLocaleName SystemTimeToFileTime MoveFileW LocalAlloc GetModuleHandleExW GetModuleFileNameW GetNativeSystemInfo GetVersionExW GetSystemTimeAsFileTime GetSystemTime GlobalMemoryStatusEx OpenProcess TerminateProcess GetCurrentProcess CreateMutexW InitializeCriticalSectionEx WaitForSingleObject GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc FindFirstFileW FindClose DeleteFileW LCMapStringW CloseHandle CreateProcessW GetCurrentProcessId FreeLibrary GetProcAddress LoadLibraryExW LoadLibraryW SetDllDirectoryW WriteFile GetStdHandle ExitProcess FreeLibraryAndExitThread ResumeThread ExitThread CreateThread VirtualProtect IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext FlsFree FlsSetValue FlsGetValue FlsAlloc RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetLocaleInfoEx Sleep LocalFree DeleteCriticalSection DecodePointer GetLastError SetStdHandle GetCurrentThreadId AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimePreciseAsFileTime QueryPerformanceCounter GetStringTypeW LeaveCriticalSection EnterCriticalSection RaiseException OutputDebugStringW

user32

PostMessageW EnumWindows GetClassNameW GetWindowThreadProcessId SystemParametersInfoW GetMessageW TranslateMessage DispatchMessageW RegisterPowerSettingNotification UnregisterPowerSettingNotification RegisterSuspendResumeNotification SendMessageTimeoutW RegisterClipboardFormatW EmptyClipboard SetClipboardData CloseClipboard UnregisterSuspendResumeNotification RegisterClassW CreateWindowExW DestroyWindow ShowWindow OpenClipboard

advapi32

ControlService AdjustTokenPrivileges EqualSid CreateProcessWithTokenW GetUserNameW SetFileSecurityW ConvertSidToStringSidW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegDeleteTreeW RegUnLoadKeyW RegNotifyChangeKeyValue RegLoadKeyW RegEnumKeyW RegDeleteKeyExW RegCreateKeyTransactedW IsWellKnownSid GetAclInformation FreeSid DuplicateTokenEx CreateWellKnownSid AllocateAndInitializeSid CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegGetValueW RegSetKeyValueW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW GetTokenInformation OpenProcessToken

shell32

SHGetFolderPathAndSubDirW SHGetFolderPathW SHCreateDirectoryExW SHSetKnownFolderPath ord526 CommandLineToArgvW SHFileOperationW SHGetSpecialFolderPathW SHGetKnownFolderPath SHChangeNotify SHParseDisplayName ShellExecuteW ShellExecuteExW SHCreateItemFromParsingName SHGetPropertyStoreFromParsingName SHAssocEnumHandlers

ole32

CoInitialize CoInitializeSecurity CoUninitialize StringFromCLSID CoTaskMemFree CoCreateInstance StringFromGUID2 CreateBindCtx CoCreateGuid CoInitializeEx CoSetProxyBlanket CreateItemMoniker GetRunningObjectTable

oleaut32

LoadTypeLi LoadRegTypeLi GetRecordInfoFromTypeInfo

crypt32

CertFindExtension CryptStringToBinaryW CryptBinaryToStringW

rpcrt4

RpcServerInqCallAttributesW UuidCreate RpcBindingFree RpcBindingFromStringBindingW RpcBindingVectorFree RpcStringBindingComposeW RpcStringFreeW RpcServerInqBindings RpcServerRegisterIfEx RpcServerUnregisterIf RpcServerUseProtseqW RpcBindingSetAuthInfoExW RpcEpRegisterW RpcEpUnregister

secur32

GetUserNameExW

shlwapi

PathRemoveFileSpecW StrStrIW SHCreateStreamOnFileW AssocQueryStringW SHRegGetBoolUSValueW SHRegGetPathW SHRegGetValueW SHSetValueW SHGetValueA SHDeleteValueW SHDeleteKeyW PathIsPrefixW SHRegGetUSValueW SHGetValueW PathStripPathW PathIsDirectoryW PathFileExistsW PathIsDirectoryEmptyW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wininet

InternetCheckConnectionW InternetCanonicalizeUrlW

wtsapi32

WTSEnumerateSessionsW WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken

userenv

CreateEnvironmentBlock GetDefaultUserProfileDirectoryW

Name

.text

Size

672KB

Virtual Size

671KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

207KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

55KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rcdf17

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_6da755989c46486428db07f5a8fa4dce_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

rpcrt4

secur32

shlwapi

version

wininet

wtsapi32

userenv

generic