2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 2.7MB
Sample260930-pdfnsstygz
SHA256 57353f04a0db7036246d16a8eb7bc3f56bdbb81e1dd32921b2717f8e753e28b5
MD5 3ca3dd9e2edd9aaa7da20abbd9dcaf9b
SHA1 5bdc57ff1667f74748ac4e2f6e3e4a0b433a5a95
SHA512 ae0cf1696b8b79f8cc26aa06e4dbdecfd68c3b587984d77770ad6652664c9957385cdd33e637d30ae479cbf2384030393d188f2dbb12da12ba521afa2af8c2cd
SSDEEP 49152:Id38ElBPsREFbY8nhxSMmT8oWgBCaX4h55RZnpUOHFbHshxSMmT8oWgBCaX:cLn+M4FHX4h55XpR9M+M4FHX
TLSH
T113D50159A6AC41F9D0B6D178CD525517EBB2BC1A5331D2CF03A0269E3F376E08E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 2.7MB

2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 7158bb792f3f6025ae398f24d105699a
SHA256 57353f04a0db7036246d16a8eb7bc3f56bdbb81e1dd32921b2717f8e753e28b5
MD5 3ca3dd9e2edd9aaa7da20abbd9dcaf9b
SHA1 5bdc57ff1667f74748ac4e2f6e3e4a0b433a5a95
SHA512 ae0cf1696b8b79f8cc26aa06e4dbdecfd68c3b587984d77770ad6652664c9957385cdd33e637d30ae479cbf2384030393d188f2dbb12da12ba521afa2af8c2cd
SSDEEP 49152:Id38ElBPsREFbY8nhxSMmT8oWgBCaX4h55RZnpUOHFbHshxSMmT8oWgBCaX:cLn+M4FHX4h55XpR9M+M4FHX
TLSH
T113D50159A6AC41F9D0B6D178CD525517EBB2BC1A5331D2CF03A0269E3F376E08E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

428528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\dbs\sh\odct\0217_173907\client\onedrive\Product\OD4\exe\obj\amd64\OneDrive.App.pdb

kernel32

GetVolumePathNameW ReadFile RemoveDirectoryW SetFileAttributesW SetFileInformationByHandle SetFilePointer GetCompressedFileSizeW FindFirstFileNameW IsDebuggerPresent SetHandleInformation CreatePipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus DeviceIoControl OpenMutexW IsWow64Process LoadLibraryExW GlobalAlloc GlobalUnlock GlobalLock GlobalFree ReadDirectoryChangesW CreateSymbolicLinkW CompareStringOrdinal CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessIoCounters GetPrivateProfileStringW WritePrivateProfileStringW CopyFileW MoveFileExW ReplaceFileW GetComputerNameW RegisterApplicationRestart GetFileInformationByHandleEx OpenFileById DecodePointer GetModuleHandleW GetDllDirectoryW WriteConsoleW ReadConsoleW SetEndOfFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetFinalPathNameByHandleW GetCommandLineA FindNextFileW FindFirstFileExW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetTimeFormatW GetDateFormatW GetFileType GetFileSizeEx GetFileSize GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindVolumeClose FindNextVolumeW FindFirstVolumeW CreateFileW CreateDirectoryW SetThreadInformation GetSystemTimes SetProcessShutdownParameters CreateProcessW GetExitCodeProcess GetProcessTimes ExpandEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW WaitForMultipleObjects Sleep CreateEventW GetLongPathNameW SetLastError VerifyVersionInfoW GetProductInfo VerSetConditionMask DeleteCriticalSection InitializeCriticalSectionEx LCMapStringW WideCharToMultiByte MultiByteToWideChar K32GetModuleFileNameExW GetUserDefaultLCID GetUserGeoID LCIDToLocaleName SystemTimeToFileTime MoveFileW LocalFree LocalAlloc GetModuleFileNameW GetVersionExW GetSystemTimeAsFileTime GetSystemTime OpenProcess GetProcAddress TerminateProcess GetCurrentProcessId GetCurrentProcess WaitForSingleObject GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc FindFirstFileW FindClose DeleteFileW CloseHandle ReleaseMutex ExitProcess WriteFile GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread VirtualProtect IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext FlsFree FlsSetValue FlsGetValue FlsAlloc RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry RaiseException OutputDebugStringW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetCurrentThreadId SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive FreeLibrary LoadLibraryW SetDllDirectoryW GetLastError CreateMutexW GetEnvironmentStringsW ReleaseSRWLockExclusive GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetLocaleInfoEx LeaveCriticalSection EnterCriticalSection GetStringTypeW GetSystemTimePreciseAsFileTime QueryPerformanceCounter

user32

FindWindowW PostMessageW RegisterClassW CreateWindowExW DefWindowProcW EnumWindows GetClassNameW GetWindowThreadProcessId SystemParametersInfoW SendMessageTimeoutW DestroyWindow RegisterClipboardFormatW EmptyClipboard SetClipboardData GetMessageW TranslateMessage DispatchMessageW RegisterPowerSettingNotification UnregisterPowerSettingNotification RegisterSuspendResumeNotification UnregisterSuspendResumeNotification ShowWindow OpenClipboard CloseClipboard

advapi32

OpenServiceW AdjustTokenPrivileges CreateProcessWithTokenW GetUserNameW SetFileSecurityW ConvertSidToStringSidW SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegDeleteTreeW RegUnLoadKeyW RegNotifyChangeKeyValue RegLoadKeyW RegEnumKeyW RegDeleteKeyExW RegCreateKeyTransactedW GetAclInformation FreeSid DuplicateTokenEx CreateWellKnownSid AllocateAndInitializeSid CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegGetValueW RegSetKeyValueW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW GetTokenInformation OpenProcessToken

shell32

SHGetFolderPathAndSubDirW SHGetFolderPathW SHCreateDirectoryExW SHAssocEnumHandlers SHSetKnownFolderPath ord526 CommandLineToArgvW SHFileOperationW SHGetSpecialFolderPathW SHGetKnownFolderPath SHChangeNotify SHParseDisplayName ShellExecuteW ShellExecuteExW SHCreateItemFromParsingName SHGetPropertyStoreFromParsingName

ole32

CoCreateInstance StringFromGUID2 CoTaskMemFree CreateBindCtx StringFromCLSID CoCreateGuid CoUninitialize CoInitializeEx CoSetProxyBlanket CreateItemMoniker GetRunningObjectTable

oleaut32

LoadTypeLi LoadRegTypeLi GetRecordInfoFromTypeInfo

crypt32

CryptBinaryToStringW CryptStringToBinaryW CertFindExtension

rpcrt4

RpcServerInqCallAttributesW UuidCreate RpcBindingFree RpcBindingFromStringBindingW RpcBindingVectorFree RpcStringBindingComposeW RpcStringFreeW RpcServerInqBindings RpcServerRegisterIfEx RpcServerUnregisterIf RpcServerUseProtseqW RpcBindingSetAuthInfoExW RpcEpRegisterW RpcEpUnregister

secur32

GetUserNameExW

shlwapi

SHCreateStreamOnFileW AssocQueryStringW SHRegGetBoolUSValueW SHRegGetPathW SHRegGetValueW SHSetValueW SHGetValueA SHDeleteValueW SHDeleteKeyW PathRemoveFileSpecW StrStrIW PathIsPrefixW PathStripPathW PathIsDirectoryW SHRegGetUSValueW SHGetValueW PathFileExistsW PathIsDirectoryEmptyW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

InternetCheckConnectionW

wtsapi32

WTSEnumerateSessionsW WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken

userenv

CreateEnvironmentBlock GetDefaultUserProfileDirectoryW

Name

.text

Size

593KB

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

185KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_3ca3dd9e2edd9aaa7da20abbd9dcaf9b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

rpcrt4

secur32

shlwapi

version

wininet

wtsapi32

userenv

generic