2026-04-17_c7984e6f96b6d00f2d86ba8b02a8c83c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

General

Target
2026-04-17_c7984e6f96b6d00f2d86ba8b02a8c83c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 590KB
Sample260417-e2jegsat9t
SHA256 b86799f3621aa63fbbb6e486d6352c7cc33ff10356e4aac40e3197774f61adcc
MD5 c7984e6f96b6d00f2d86ba8b02a8c83c
SHA1 98ea78e64da213705241f53120b7cf367c70a762
SHA512 2c0824e4fb8ac7035649d4ec9cf391a8ee9529e5a5437a302405194348f14b769253fb68eb64ef546001ec31f2963488ca72e1def336f0a96b4980625e1223f7
SSDEEP 12288:eoTKuGyBSopZ1e3bgm5cEzciY0vvMD8m8DZ0nol+c:eoTKpopZ1e3bZ5Bcivv9r10C
TLSH
T1E1D45B36639800EDE0B791388E076953FA76740603718AFF03D156A62E5FAF46F3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-17_c7984e6f96b6d00f2d86ba8b02a8c83c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-04-17_c7984e6f96b6d00f2d86ba8b02a8c83c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 590KB

2026-04-17_c7984e6f96b6d00f2d86ba8b02a8c83c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH e16be8395ea2cd8d75e5bb750ad4c7d3
SHA256 b86799f3621aa63fbbb6e486d6352c7cc33ff10356e4aac40e3197774f61adcc
MD5 c7984e6f96b6d00f2d86ba8b02a8c83c
SHA1 98ea78e64da213705241f53120b7cf367c70a762
SHA512 2c0824e4fb8ac7035649d4ec9cf391a8ee9529e5a5437a302405194348f14b769253fb68eb64ef546001ec31f2963488ca72e1def336f0a96b4980625e1223f7
SSDEEP 12288:eoTKuGyBSopZ1e3bgm5cEzciY0vvMD8m8DZ0nol+c:eoTKpopZ1e3bZ5Bcivv9r10C
TLSH
T1E1D45B36639800EDE0B791388E076953FA76740603718AFF03D156A62E5FAF46F3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables referencing combination of virtualization drivers
Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

242580

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

SetThreadToken OpenProcessToken AdjustTokenPrivileges DuplicateTokenEx LookupPrivilegeValueA GetUserNameA RegCloseKey RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA RegGetValueA

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject

user32

GetDC GetSystemMetrics GetClipboardData CloseClipboard OpenClipboard ReleaseDC

kernel32

SetEndOfFile WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW GetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetDiskFreeSpaceExA GetFileAttributesA GetFileSize ReadFile SetFileAttributesA SetFilePointer WriteFile IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle GetLastError CreatePipe QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject CreateMutexA Sleep GetCurrentProcess GetExitCodeProcess CreateThread CreateProcessA OpenProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount GetModuleFileNameA GetProcAddress LoadLibraryA GlobalUnlock GlobalLock LocalFree lstrcmpiA lstrcpyA CopyFileA GetComputerNameA CreateToolhelp32Snapshot Process32First Process32Next EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW FreeEnvironmentStringsW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation HeapReAlloc FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW RtlUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-17_c7984e6f96b6d00f2d86ba8b02a8c83c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

advapi32

gdi32

user32

kernel32

generic