2026-10-11_835871ca662b90bbdda0200863c0ad47_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

General

Target
2026-10-11_835871ca662b90bbdda0200863c0ad47_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 1.3MB
Sample261012-vwpmbaytft
SHA256 3d5d1aa4c17cea379cc5da383a2a0a88d7e3767a4ee7a0f4e567f00a2c8f0c6e
MD5 835871ca662b90bbdda0200863c0ad47
SHA1 281e66205a7e5b6f5c1c2f5d03acae135b45175a
SHA512 f49c9f4054c468f2acd0b8473a85a071daf61f667838202ea0d8cd56f8cc6f76dbae724626cc861bbf5f207e5cd0fc5d58de4241f9715058c1a4a99b540d606f
SSDEEP 24576:+LLmC7dThWtJLijmASnnrFb4PM4MYgLxEVyGLw:NeThxmTj4MYPVyGLw
TLSH
T13B55AE6066090AFCEAF1B634DBDE5351D3A13C52023795CF13D07F8A3E37A52AE6A251
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_835871ca662b90bbdda0200863c0ad47_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-10-11_835871ca662b90bbdda0200863c0ad47_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 1.3MB

2026-10-11_835871ca662b90bbdda0200863c0ad47_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 6d4617f27a5c1346e12b4aa143ce3b95
SHA256 3d5d1aa4c17cea379cc5da383a2a0a88d7e3767a4ee7a0f4e567f00a2c8f0c6e
MD5 835871ca662b90bbdda0200863c0ad47
SHA1 281e66205a7e5b6f5c1c2f5d03acae135b45175a
SHA512 f49c9f4054c468f2acd0b8473a85a071daf61f667838202ea0d8cd56f8cc6f76dbae724626cc861bbf5f207e5cd0fc5d58de4241f9715058c1a4a99b540d606f
SSDEEP 24576:+LLmC7dThWtJLijmASnnrFb4PM4MYgLxEVyGLw:NeThxmTj4MYPVyGLw
TLSH
T13B55AE6066090AFCEAF1B634DBDE5351D3A13C52023795CF13D07F8A3E37A52AE6A251
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

179212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildworker\steam_rel_client_win64\build\src\drivers\win32\steamxboxutil\win64\Release\steamxboxutil64.pdb

kernel32

LoadLibraryW LocalAlloc LocalFree lstrlenW GetProcAddress CloseHandle DeviceIoControl GetOverlappedResult CreateEventA WriteConsoleW FreeLibrary SetLastError CreateFileW GetLastError HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation WideCharToMultiByte MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetLocaleInfoEx GetStringTypeW CompareStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW

ole32

CoUninitialize CoCreateInstance CoInitialize

setupapi

CM_Get_DevNode_Status SetupDiSetClassInstallParamsW SetupDiSetDeviceRegistryPropertyW SetupDiGetDeviceRegistryPropertyW SetupDiOpenClassRegKey SetupDiCallClassInstaller SetupDiGetClassDevsW SetupCopyOEMInfW SetupDiGetDriverInfoDetailW SetupDiEnumDriverInfoW SetupDiBuildDriverInfoList SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiCreateDeviceInfoW SetupDiCreateDeviceInfoList SetupDiDestroyDriverInfoList

Name

.text

Size

327KB

Virtual Size

327KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

294KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_835871ca662b90bbdda0200863c0ad47_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

kernel32

advapi32

ole32

setupapi

generic