C:\buildworker\steam_rel_client_win64\build\src\webhelper\win64\Release\steamwebhelper.pdb
Static task
static1
Behavioral task
behavioral1
Sample
2025-07-02_e4f2fd5ed5fd110282956b5b891e07b1_black-basta_cobalt-strike_coinminer_luca-stealer_satacom_vidar.exe
Resource
win10v2004-20250610-en
Behavioral task
behavioral2
Sample
2025-07-02_e4f2fd5ed5fd110282956b5b891e07b1_black-basta_cobalt-strike_coinminer_luca-stealer_satacom_vidar.exe
Resource
win11-20250610-en
General
-
Target
2025-07-02_e4f2fd5ed5fd110282956b5b891e07b1_black-basta_cobalt-strike_coinminer_luca-stealer_satacom_vidar
-
Size
7.8MB
-
MD5
e4f2fd5ed5fd110282956b5b891e07b1
-
SHA1
5ec14b8d616f7413d470720b2c7d5fe5b72c70d3
-
SHA256
63cce6af3033add38ac037210a7ae27b15c089889c419d88111ae5e8af34d860
-
SHA512
36cf27d0a408057b4707185287ac673ae252f300e1a7602bb1872c4a45d97f1a7ce0779bcc48d183fa3c80c8c4aa19d62f521df69703febb7ec9d809b8580fe3
-
SSDEEP
196608:5Q1OREBrYnn3iwAEbEjMfrzxi/WJrIrQrrrrrrrrHwrrrrrrrrrrrrGrrrrrVrrx:5QgREBrYnnywZbEjirFi/Jpx
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2025-07-02_e4f2fd5ed5fd110282956b5b891e07b1_black-basta_cobalt-strike_coinminer_luca-stealer_satacom_vidar
Files
-
2025-07-02_e4f2fd5ed5fd110282956b5b891e07b1_black-basta_cobalt-strike_coinminer_luca-stealer_satacom_vidar.exe windows:6 windows x64 arch:x64
702e286989e5c28ba71467243f0a9637
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
kernel32
MoveFileExW
VerifyVersionInfoW
MultiByteToWideChar
Sleep
GetSystemTime
ReadConsoleA
SetConsoleMode
ConvertFiberToThread
DeleteFiber
OutputDebugStringA
WriteFile
RemoveDirectoryW
GetLongPathNameW
GetFullPathNameW
DeleteFileW
CreateFileA
CreateDirectoryW
VerSetConditionMask
GetModuleFileNameW
SetPriorityClass
GetEnvironmentVariableA
GetCommandLineW
DeviceIoControl
GetFileAttributesW
FindFirstFileW
FindClose
CreateFileW
Process32Next
Process32First
CreateToolhelp32Snapshot
CreateFileMappingA
WriteConsoleW
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
LocalFree
LocalAlloc
GlobalLock
GlobalUnlock
GlobalAlloc
IsWow64Process
ReadProcessMemory
GetProductInfo
GetVersionExA
UnmapViewOfFile
MapViewOfFile
CreateEventA
ResetEvent
SetEvent
GetUserDefaultLangID
GetLocaleInfoA
GetTempPathA
SetEnvironmentVariableA
GetModuleHandleExA
WriteProcessMemory
VirtualAllocEx
VirtualQuery
VirtualProtect
GetSystemInfo
FlushInstructionCache
GetCurrentThreadId
GetCurrentThread
CreateMutexA
WaitForSingleObject
ReleaseMutex
DeleteCriticalSection
InitializeCriticalSection
LoadLibraryA
FreeLibrary
SetLastError
GetModuleHandleA
GetExitCodeProcess
OpenProcess
GetCurrentProcessId
GetCurrentProcess
DuplicateHandle
CloseHandle
GetLastError
LeaveCriticalSection
GetLocaleInfoW
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetStdHandle
SetStdHandle
SetConsoleCtrlHandler
HeapValidate
HeapSize
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
PeekNamedPipe
RtlUnwind
RtlPcToFileHeader
RtlUnwindEx
GetCPInfo
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
InitOnceComplete
InitOnceBeginInitialize
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlCaptureContext
ExitProcess
RtlVirtualUnwind
RtlLookupFunctionEntry
GetEnvironmentVariableW
WakeAllConditionVariable
SleepConditionVariableSRW
SetFilePointerEx
CreateRemoteThread
VirtualFreeEx
QueryDosDeviceW
CreateMutexW
ExpandEnvironmentStringsW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
VirtualProtectEx
QueryInformationJobObject
CreateJobObjectW
FormatMessageW
GetLocalTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
AcquireSRWLockExclusive
HeapDestroy
EnumSystemLocalesEx
GetProcessHandleCount
GetCurrentProcessorNumber
CreateEventW
CreateFileMappingW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetNativeSystemInfo
GetVersionExW
SetProcessMitigationPolicy
GetProcessMitigationPolicy
SetDefaultDllDirectories
SetHandleInformation
GetFileType
SetThreadInformation
GetThreadId
UnregisterWaitEx
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
RegisterWaitForSingleObject
GetTickCount
GetUserDefaultLocaleName
GetUserDefaultLCID
SetInformationJobObject
GetModuleHandleExW
PostQueuedCompletionStatus
TerminateJobObject
GetQueuedCompletionStatus
CreateIoCompletionPort
SetProcessAffinityMask
GetProcessHeaps
DebugBreak
GetProcessAffinityMask
SetEnvironmentVariableW
SetUnhandledExceptionFilter
QueryPerformanceFrequency
QueryPerformanceCounter
IsDebuggerPresent
HeapQueryInformation
HeapWalk
HeapUnlock
EnterCriticalSection
GetProcAddress
GetModuleHandleW
LoadLibraryExW
OutputDebugStringW
GetSystemDirectoryW
lstrcmpA
FindFirstFileExW
FlushFileBuffers
GetDiskFreeSpaceA
GetDriveTypeW
GetFileInformationByHandle
GetFileSizeEx
ReadFile
SetEndOfFile
SetFileAttributesW
SetFilePointer
SetFileTime
SleepEx
GetSystemTimeAsFileTime
ReplaceFileW
GetDateFormatW
GetTimeFormatW
LoadLibraryExA
LoadLibraryW
FileTimeToSystemTime
RtlCaptureStackBackTrace
TerminateProcess
GlobalMemoryStatusEx
VirtualAlloc
VirtualFree
GetModuleFileNameA
RaiseException
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
SwitchToThread
CreateThread
OpenThread
SetThreadPriority
TerminateThread
GetExitCodeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetThreadAffinityMask
GetCommandLineA
HeapAlloc
HeapFree
GetProcessHeap
HeapSetInformation
HeapLock
user32
IsWindow
CallWindowProcW
CallWindowProcA
MessageBoxW
GetWindowPlacement
SendMessageA
FlashWindow
ShowWindow
AllowSetForegroundWindow
SetWindowPos
FlashWindowEx
IsWindowVisible
IsIconic
IsZoomed
SetFocus
SendInput
GetSystemMetrics
GetForegroundWindow
ReleaseDC
DestroyIcon
GetWindowThreadProcessId
EnumWindows
wsprintfA
DialogBoxParamA
EndDialog
GetDlgItem
SetDlgItemInt
GetDlgItemInt
SetDlgItemTextA
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetWindowTextLengthA
MessageBoxA
CloseDesktop
CloseWindowStation
GetProcessWindowStation
CreateWindowStationW
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
GetUserObjectInformationW
GetClassLongPtrA
GetDoubleClickTime
SendMessageTimeoutA
GetIconInfo
GetAncestor
GetMonitorInfoW
MonitorFromWindow
MonitorFromRect
LoadImageA
GetWindow
EnumChildWindows
SetParent
GetParent
GetDesktopWindow
SetWindowLongPtrW
SetWindowLongPtrA
GetWindowLongPtrA
PtInRect
ScreenToClient
GetWindowRect
GetClientRect
RemovePropW
GetPropW
SetPropW
GetDC
gdi32
GetObjectA
CreateDIBSection
SelectObject
GetBitmapBits
DeleteDC
CreateCompatibleDC
BitBlt
SetRectRgn
PtInRegion
GetDeviceCaps
DeleteObject
CreateRectRgn
CombineRgn
advapi32
GetLengthSid
RegisterEventSourceW
DeregisterEventSource
ConvertStringSidToSidW
SetEntriesInAclW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyExA
SetTokenInformation
DuplicateTokenEx
AdjustTokenPrivileges
CreateProcessAsUserW
SetSecurityDescriptorDacl
IsValidSid
InitializeSecurityDescriptor
InitializeAcl
GetTokenInformation
CreateWellKnownSid
CopySid
AddAccessAllowedAce
OpenProcessToken
RegQueryValueExA
RegOpenKeyA
RegCloseKey
RevertToSelf
RegDisablePredefinedCache
OpenThreadToken
LookupPrivilegeValueW
CreateRestrictedToken
SetThreadToken
FreeSid
ConvertSidToStringSidW
EqualSid
GetAce
IsValidSecurityDescriptor
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetNamedSecurityInfoW
GetSecurityInfo
SetSecurityInfo
MapGenericMask
AccessCheck
IsValidAcl
AddMandatoryAce
BuildTrusteeWithSidW
ReportEventW
shell32
ExtractIconExA
Shell_NotifyIconA
SHAppBarMessage
SHGetKnownFolderPath
CommandLineToArgvW
ole32
CoInitializeEx
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
PropVariantClear
CoUninitialize
oleaut32
VariantClear
winmm
timeGetTime
psapi
GetModuleFileNameExA
GetModuleBaseNameA
GetProcessMemoryInfo
api-ms-win-core-processenvironment-l1-1-0
GetCurrentDirectoryW
api-ms-win-core-file-l1-1-0
FindNextFileW
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
sdl3
SDL_GetGlobalMouseState
SDL_SetWindowHitTest
SDL_SetWindowFullscreen
SDL_RestoreWindow
SDL_MinimizeWindow
SDL_MaximizeWindow
SDL_RaiseWindow
SDL_ShowWindow
SDL_GetWindowMaximumSize
SDL_SetWindowMaximumSize
SDL_GetWindowMinimumSize
SDL_SetWindowMinimumSize
SDL_SetWindowIcon
SDL_SetWindowTitle
SDL_GetWindowFlags
SDL_GetWindowID
SDL_GetDisplayForWindow
SDL_GetDisplayUsableBounds
SDL_GetDisplayBounds
SDL_GetDisplayName
SDL_GetPrimaryDisplay
SDL_RenderTexture
SDL_CreateTextureFromSurface
SDL_CreateRenderer
SDL_Init
SDL_SetHint
SDL_PollEvent
SDL_HideWindow
SDL_SetWindowSize
SDL_SetWindowPosition
SDL_CreateWindow
SDL_DestroyRenderer
SDL_RenderPresent
SDL_RenderClear
SDL_SetRenderDrawColor
SDL_CreateSoftwareRenderer
SDL_GetWindowSurface
SDL_GetTicksNS
SDL_DestroySurface
SDL_CreateSurfaceFrom
SDL_GL_DestroyContext
SDL_GL_SwapWindow
SDL_GL_MakeCurrent
SDL_GL_CreateContext
SDL_DestroyWindow
SDL_GetWindowSize
SDL_GetWindowPosition
SDL_GetWindowFromID
SDL_CreateWindowWithProperties
SDL_CreatePopupWindow
SDL_DestroyProperties
SDL_SetNumberProperty
SDL_SetStringProperty
SDL_CreateProperties
SDL_GetError
SDL_roundf
SDL_GetDisplayForPoint
SDL_GetDisplayContentScale
SDL_SetAppMetadata
SDL_AddEventWatch
SDL_PeepEvents
SDL_PumpEvents
SDL_GetWindowProperties
SDL_GetPointerProperty
SDL_PushEvent
SDL_GetWindowParent
libcef
cef_list_value_create
cef_process_message_create
cef_v8context_get_current_context
cef_string_list_alloc
cef_string_list_free
cef_v8value_create_undefined
cef_v8value_create_null
cef_v8value_create_bool
cef_v8value_create_int
cef_v8value_create_uint
cef_v8value_create_double
cef_v8value_create_string
cef_v8value_create_object
cef_v8value_create_array
cef_v8value_create_array_buffer
cef_v8value_create_function
cef_v8value_create_promise
cef_dictionary_value_create
cef_stream_reader_create_for_file
cef_stream_reader_create_for_data
cef_string_multimap_alloc
cef_string_multimap_free
cef_request_create
cef_currently_on
cef_post_task
cef_post_delayed_task
cef_execute_process
cef_initialize
cef_shutdown
cef_do_message_loop_work
cef_run_message_loop
cef_quit_message_loop
cef_set_force_device_scale_factor
cef_get_device_scale_factor_for_screen_rect
cef_is_hardware_acceleration_enabled
cef_is_gpu_compositing_disabled
cef_generate_gpu_report
cef_crash_reporting_enabled
cef_binary_value_create
cef_parse_url
cef_api_hash
cef_urlrequest_create
cef_post_data_create
cef_post_data_element_create
cef_cookie_manager_get_global_manager
cef_browser_host_create_browser
cef_string_map_alloc
cef_string_map_free
cef_command_line_create
cef_command_line_get_global
cef_string_list_size
cef_string_list_value
cef_string_list_append
cef_string_map_size
cef_string_map_key
cef_string_map_value
cef_string_map_append
cef_string_multimap_size
cef_string_multimap_key
cef_string_multimap_value
cef_string_multimap_append
cef_log
cef_string_utf8_set
cef_string_utf8_clear
cef_string_utf8_cmp
cef_string_wide_to_utf8
cef_string_utf16_clear
cef_string_utf8_to_utf16
cef_string_userfree_utf8_free
cef_set_crash_key_value
ws2_32
WSACleanup
WSASetLastError
recv
send
closesocket
WSAGetLastError
dbghelp
SymSetOptions
SymGetSearchPathW
SymSetSearchPathW
SymFromAddr
SymGetLineFromAddr64
SymCleanup
SymInitialize
userenv
CreateAppContainerProfile
DeriveAppContainerSidFromAppContainerName
ntdll
RtlInitUnicodeString
bcrypt
BCryptGenRandom
Exports
Exports
CreateInterface
GetHandleVerifier
IsSandboxedProcess
g_dwDllEntryThreadId
Sections
.text Size: 4.7MB - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 120KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 225KB - Virtual size: 225KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
prot Size: 512B - Virtual size: 116B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 826KB - Virtual size: 826KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 624KB - Virtual size: 628KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE