2026-09-29_5827ffbfdff4173eadda77ab4a49f45b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

General

Target
2026-09-29_5827ffbfdff4173eadda77ab4a49f45b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 4.1MB
Sample260930-aw1dlatdnf
SHA256 9a8fc3c8055af4ec6536f5dc10b0367759c4f5bd0cbe7dd5ec01155251362d27
MD5 5827ffbfdff4173eadda77ab4a49f45b
SHA1 8e060e1745dd02c962622647333f7a6d4495d6c5
SHA512 291de08ea9f46de9751229a24868b8f739fdaa24b5f8a445d7b4b5311dc736c720694e16912ae747f6d9f2a56d8b912ce634e8828a029d2684e1cb66b2ee5943
SSDEEP 49152:yrnIkCycDMiX5t5FMEpBx8QkXUCRF5VhioWXQ3lxVOSzRYNlCxj4MYPVyGLoLzpP:CEt8QorCVUBz3u2V7
TLSH
T15E16D062B35840EDD077D2F88A965B43E371F84107B057CB20E09AAA2F7B9D65D7AF01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_5827ffbfdff4173eadda77ab4a49f45b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-09-29_5827ffbfdff4173eadda77ab4a49f45b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 4.1MB

2026-09-29_5827ffbfdff4173eadda77ab4a49f45b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH b6ce8ab4e78587160f528b21f9ea123c
SHA256 9a8fc3c8055af4ec6536f5dc10b0367759c4f5bd0cbe7dd5ec01155251362d27
MD5 5827ffbfdff4173eadda77ab4a49f45b
SHA1 8e060e1745dd02c962622647333f7a6d4495d6c5
SHA512 291de08ea9f46de9751229a24868b8f739fdaa24b5f8a445d7b4b5311dc736c720694e16912ae747f6d9f2a56d8b912ce634e8828a029d2684e1cb66b2ee5943
SSDEEP 49152:yrnIkCycDMiX5t5FMEpBx8QkXUCRF5VhioWXQ3lxVOSzRYNlCxj4MYPVyGLoLzpP:CEt8QorCVUBz3u2V7
TLSH
T15E16D062B35840EDD077D2F88A965B43E371F84107B057CB20E09AAA2F7B9D65D7AF01
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2506904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FindClose FindFirstFileExW FindNextFileW GetFullPathNameW CloseHandle GetLastError GetCurrentProcessId VirtualQuery MapViewOfFile UnmapViewOfFile CreateFileMappingA GetStdHandle GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA SetHandleInformation ReleaseMutex WaitForSingleObject CreateMutexA TerminateProcess GetExitCodeProcess ResumeThread CreateProcessA AssignProcessToJobObject SetInformationJobObject CreateJobObjectA CreateDirectoryA SetFileTime GetSystemTime GetModuleFileNameA GetModuleHandleA SystemTimeToFileTime FlushFileBuffers ReadFile WriteFile DuplicateHandle SetUnhandledExceptionFilter SetErrorMode GetOverlappedResult ResetEvent CreateEventA SetWaitableTimer WaitForMultipleObjects GetCurrentProcess ExitProcess FormatMessageA OpenMutexA CreateWaitableTimerA OpenFileMappingA CreateNamedPipeA LoadLibraryA GetProcAddress WriteConsoleW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime WaitForSingleObjectEx Sleep GetExitCodeThread GetLogicalProcessorInformationEx WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetTickCount64 WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree FreeLibrary GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread CreateFileW GetFileType GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetConsoleCtrlHandler IsProcessorFeaturePresent GetModuleFileNameW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode ReadConsoleW SetFilePointerEx GetFileSizeEx HeapReAlloc DeleteFileW SetStdHandle SetEndOfFile GetCurrentDirectoryW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize RtlUnwind

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

665KB

Virtual Size

665KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

72KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_5827ffbfdff4173eadda77ab4a49f45b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

kernel32

generic