2026-09-30_2ea96a83313bae73211bef2be3d537c7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_2ea96a83313bae73211bef2be3d537c7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 3.0MB
Sample260930-ptt65avy8r
SHA256 6e35e4ab50b159c0b1ed00c0f36df2a0f2004dd18e26be6ad44476af92665645
MD5 2ea96a83313bae73211bef2be3d537c7
SHA1 353275f8eadd6fa2b2f6080bed437cbf3a9957fe
SHA512 aaac20ff6a13c47274ee3b5cf16f1b18683ed4d74928822ff0e24d7a124fa286332e96a6dbb42bebc1d5784179038fea4c81ce185ed7515f463b5cdc10bfc8ee
SSDEEP 49152:SDMMfdJIcykCMDsGLBDlb4dUKIvw9buA4M91b0xe/9A4/YaX25:4WcPsCplbm6+n3gxKzQam
TLSH
T1F7E50265A3D910E9E473C278C9A39513EB72BC164330EADF03A495252F337D56E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_2ea96a83313bae73211bef2be3d537c7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-09-30_2ea96a83313bae73211bef2be3d537c7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 3.0MB

2026-09-30_2ea96a83313bae73211bef2be3d537c7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 067fc593f37279d4d0f62899ec557bda
SHA256 6e35e4ab50b159c0b1ed00c0f36df2a0f2004dd18e26be6ad44476af92665645
MD5 2ea96a83313bae73211bef2be3d537c7
SHA1 353275f8eadd6fa2b2f6080bed437cbf3a9957fe
SHA512 aaac20ff6a13c47274ee3b5cf16f1b18683ed4d74928822ff0e24d7a124fa286332e96a6dbb42bebc1d5784179038fea4c81ce185ed7515f463b5cdc10bfc8ee
SSDEEP 49152:SDMMfdJIcykCMDsGLBDlb4dUKIvw9buA4M91b0xe/9A4/YaX25:4WcPsCplbm6+n3gxKzQam
TLSH
T1F7E50265A3D910E9E473C278C9A39513EB72BC164330EADF03A495252F337D56E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

187936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdiplusStartup GdipFree GdiplusShutdown GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipGetGenericFontFamilySansSerif GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipResetClip GdipSetClipRegion GdipDrawImageRectI GdipFillPath GdipFillEllipseI GdipFillPolygon GdipFillRectangleI GdipGraphicsClear GdipDrawClosedCurve2 GdipDrawPath GdipDrawEllipseI GdipDrawRectangleI GdipDrawLineI GdipSetTextRenderingHint GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipDisposeImage GdipCloneImage GdipLoadImageFromStream GdipSetPenLineCap197819 GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipDeleteRegion GdipCreateRegionRectI GdipAddPathRectangleI GdipAddPathArcI GdipClosePathFigure GdipDeletePath GdipCreatePath GdipAlloc

user32

SetWindowDisplayAffinity OpenClipboard CloseClipboard GetMessageW TranslateMessage DispatchMessageW RegisterHotKey SendMessageW SetWindowPos PostQuitMessage RegisterClassW RegisterClassExW SetLayeredWindowAttributes UpdateLayeredWindow ShowWindow GetClipboardData EnumDisplaySettingsW LoadIconW LoadCursorW SetWindowLongPtrW DefWindowProcW DestroyWindow GetWindowLongPtrW SetWindowLongW GetWindowLongW PtInRect WindowFromPoint GetCursorPos MessageBoxW GetClientRect SetWindowTextW InvalidateRect SetWindowRgn EndPaint BeginPaint ReleaseDC GetDC UpdateWindow GetSystemMetrics KillTimer SetTimer ReleaseCapture SetCapture SendInput GetAsyncKeyState GetKeyState SetFocus CreateWindowExW

gdi32

CreateRoundRectRgn BitBlt DeleteDC DeleteObject SelectObject CreateDIBSection CreateCompatibleBitmap CreateCompatibleDC

kernel32

GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW GetFileType UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetProcAddress IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread FlsFree FlsSetValue FlsGetValue HeapReAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetSystemTimeAsFileTime GetModuleHandleW GetStartupInfoW GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer WakeAllConditionVariable QueryPerformanceCounter DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCurrentThreadId GetLastError FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize WriteConsoleW SetEndOfFile FlsAlloc GetEnvironmentVariableW GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW ReadFile RemoveDirectoryW WriteFile GetTempPathW GetTempPathA OutputDebugStringW CloseHandle SetHandleInformation SetUnhandledExceptionFilter CreatePipe HeapAlloc HeapFree GetProcessHeap DeviceIoControl WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess GetExitCodeProcess CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute OpenProcess GetLocalTime GetTickCount GetTickCount64 VirtualProtect RtlUnwind WriteProcessMemory GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryFullProcessImageNameW CopyFileW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW K32GetProcessMemoryInfo GetComputerNameA ReadProcessMemory

winhttp

WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpReadData WinHttpSendRequest

ole32

CreateStreamOnHGlobal

dwmapi

DwmExtendFrameIntoClientArea DwmFlush

winmm

timeBeginPeriod timeEndPeriod

shell32

ShellExecuteExW

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey GetTokenInformation OpenProcessToken

shlwapi

PathFileExistsW

Name

.text

Size

327KB

Virtual Size

327KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_2ea96a83313bae73211bef2be3d537c7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

gdiplus

user32

gdi32

kernel32

winhttp

ole32

dwmapi

winmm

shell32

advapi32

shlwapi

generic