2026-10-19_56e45d24ed40a7c1e1026d83b1dfea78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

General

Target
2026-10-19_56e45d24ed40a7c1e1026d83b1dfea78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 13.3MB
Sample261020-ymmcdaes9t
SHA256 f525eb14b1793670fbb9256d4245739cdf47cc1a81edbad9b0f054ee154656ec
MD5 56e45d24ed40a7c1e1026d83b1dfea78
SHA1 81712a2d83199d5d3af7ef004e97e7a9a42b6830
SHA512 2299ed19d85cee216d7b31559febc8f4056c1a8eb6a02118963d78e78198167bfc8def2429c04bcd93c439bdbe0050b2b7e24ab9a9def167402d8425428f6aed
SSDEEP 393216:RzHR0VKh6JKS2cvMwwLoO0iuHnFryQZ435N6Icp3JU7H2u3AL3d1QambftbCEnMd:dHR0QhanMBUOHuHF
TLSH
T14AE6E116F7490146CB309EF74A835966DBE738460B6522E33F9ABD042F372D447BC6A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_56e45d24ed40a7c1e1026d83b1dfea78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-10-19_56e45d24ed40a7c1e1026d83b1dfea78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 13.3MB

2026-10-19_56e45d24ed40a7c1e1026d83b1dfea78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 7156e913121240010141a1fca94222a1
SHA256 f525eb14b1793670fbb9256d4245739cdf47cc1a81edbad9b0f054ee154656ec
MD5 56e45d24ed40a7c1e1026d83b1dfea78
SHA1 81712a2d83199d5d3af7ef004e97e7a9a42b6830
SHA512 2299ed19d85cee216d7b31559febc8f4056c1a8eb6a02118963d78e78198167bfc8def2429c04bcd93c439bdbe0050b2b7e24ab9a9def167402d8425428f6aed
SSDEEP 393216:RzHR0VKh6JKS2cvMwwLoO0iuHnFryQZ435N6Icp3JU7H2u3AL3d1QambftbCEnMd:dHR0QhanMBUOHuHF
TLSH
T14AE6E116F7490146CB309EF74A835966DBE738460B6522E33F9ABD042F372D447BC6A2
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

55736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\moxxie internal\Lootline\x64\Release\Selene.pdb

kernel32

SizeofResource WriteProcessMemory GetModuleFileNameW GetEnvironmentVariableW GetTempPathW WaitForSingleObject OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Sleep FormatMessageW GetLastError Process32NextW LoadLibraryA LockResource Process32FirstW CloseHandle LoadResource FindResourceW Module32FirstW GetProcAddress VirtualAllocEx LocalFree GetModuleHandleW FlushInstructionCache CreateRemoteThread Module32NextW VirtualFreeEx SetConsoleTitleW SetEndOfFile FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW SetFileInformationByHandle CreateFile2 GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapFree HeapAlloc VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetStdHandle ReadFile ReadConsoleW CreateFileW SetConsoleMode ReadConsoleInputW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW HeapSize RtlUnwind

Name

.text

Size

188KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13.0MB

Virtual Size

13.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_56e45d24ed40a7c1e1026d83b1dfea78_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

kernel32

generic