stealc | 2026-11-09_9d48741cc828c628b3262a9dd9a9b1f3_cobalt-strike_icedid_njrat_satacom_stealc

General

Target
2026-11-09_9d48741cc828c628b3262a9dd9a9b1f3_cobalt-strike_icedid_njrat_satacom_stealc
Size 623KB
Sample261109-25f5vsbb78
SHA256 e343278d37a4754c78d8443f407ec9c72d4f77c9506d2bb2dc43bf56c993b9e4
MD5 9d48741cc828c628b3262a9dd9a9b1f3
SHA1 6a0f23850f1f11c20aa560e7f96951911bc44657
SHA512 f3ec7c2cf3376cbce5432afbc7c4d1aebc18839b519bf0e7838c68e9f1fb9406e4bb6df992884fa69272dcaf01381889739f081c6b4f7bdf04a610cce7e9533c
SSDEEP 6144:aEOqNAdZH7oKXVXf0QBiG4fia6gjsY9APxGDTKSktLAChiRJNJ3oPFZWB1Qc/jV/:aEcFV0QB54fiaxjsY9xoG3Yc1vdF5m
TLSH
T11BD47D56EBA503F8D17BC1B4CA828856EB76F815433456CB03E249635F3B6A05B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

12345 stealer stealc

Malware Config

Extracted

Family

stealc

Botnet

12345

C2

http://5.104.73.169

rc4.traffic_key

rc4.plain

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 3 1 IoCs

resource	yara_rule
sample	family_stealc_v3

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_9d48741cc828c628b3262a9dd9a9b1f3_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-11-09_9d48741cc828c628b3262a9dd9a9b1f3_cobalt-strike_icedid_njrat_satacom_stealc

.exe 623KB

2026-11-09_9d48741cc828c628b3262a9dd9a9b1f3_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH a1fa2d08960884e06f2dc59bd5f7a43c
SHA256 e343278d37a4754c78d8443f407ec9c72d4f77c9506d2bb2dc43bf56c993b9e4
MD5 9d48741cc828c628b3262a9dd9a9b1f3
SHA1 6a0f23850f1f11c20aa560e7f96951911bc44657
SHA512 f3ec7c2cf3376cbce5432afbc7c4d1aebc18839b519bf0e7838c68e9f1fb9406e4bb6df992884fa69272dcaf01381889739f081c6b4f7bdf04a610cce7e9533c
SSDEEP 6144:aEOqNAdZH7oKXVXf0QBiG4fia6gjsY9APxGDTKSktLAChiRJNJ3oPFZWB1Qc/jV/:aEcFV0QB54fiaxjsY9xoG3Yc1vdF5m
TLSH
T11BD47D56EBA503F8D17BC1B4CA828856EB76F815433456CB03E249635F3B6A05B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Stealc stealer Version 3
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

286224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

MultiByteToWideChar LoadLibraryA GetProcAddress GetCurrentProcess SetEndOfFile QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId WideCharToMultiByte GetStringTypeW GetLocaleInfoEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode CloseHandle VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW GetTimeZoneInformation IsValidCodePage GetACP GetOEMCP HeapReAlloc FindClose FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize WriteConsoleW RtlUnwind

Name

.text

Size

451KB

Virtual Size

451KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

46KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-11-09_9d48741cc828c628b3262a9dd9a9b1f3_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

generic