2026-05-10_e3c776dcca21feb1b75b184fac0c1c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-10_e3c776dcca21feb1b75b184fac0c1c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 386KB
Sample260510-2amn6aa16p
SHA256 67d23fdfe43322d983c7140e2a396b8aad61182fb72535933b7de19be393d5bb
MD5 e3c776dcca21feb1b75b184fac0c1c91
SHA1 2be6b65e857834dfa3be92a57aeeb8264d5ac794
SHA512 8955135a4fde3d6a6a80e806d432cb23fde66448f457b39fc6e2c26167d58d0c0aea43f7d16f4dce9eeaa156930e8e91372fb9aa263b64b18c4c53752054dedc
SSDEEP 6144:ddVxWT8Phx1bwcQQkgSHGGTJAraZ/tmWliYZk:ddGihx18cQgSHGGJiQYcu
TLSH
T10B846B866B684DF2E9F38138C5927606D7717C6D4BB1CADFA720068F6E2B3D15838721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-05-10_e3c776dcca21feb1b75b184fac0c1c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 386KB

2026-05-10_e3c776dcca21feb1b75b184fac0c1c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH ce07cbc91d8ae929246b2c4ed19aebc7
SHA256 67d23fdfe43322d983c7140e2a396b8aad61182fb72535933b7de19be393d5bb
MD5 e3c776dcca21feb1b75b184fac0c1c91
SHA1 2be6b65e857834dfa3be92a57aeeb8264d5ac794
SHA512 8955135a4fde3d6a6a80e806d432cb23fde66448f457b39fc6e2c26167d58d0c0aea43f7d16f4dce9eeaa156930e8e91372fb9aa263b64b18c4c53752054dedc
SSDEEP 6144:ddVxWT8Phx1bwcQQkgSHGGTJAraZ/tmWliYZk:ddGihx18cQgSHGGJiQYcu
TLSH
T10B846B866B684DF2E9F38138C5927606D7717C6D4BB1CADFA720068F6E2B3D15838721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

63:43:ad:8f:46:79:9f:44:ea:56:c9:40:92:44:ad:8f:ed:e1:42:44:20:20:5a:6a:3b:b1:9c:9b:32:73:3e:99

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Cisco Systems\, Inc.,O=Cisco Systems\, Inc.,L=San Jose,ST=California,C=US

Chains

Apr 22, 2026

CN=Cisco Systems\, Inc.,O=Cisco Systems\, Inc.,L=San Jose,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Cisco Systems\, Inc.,O=Cisco Systems\, Inc.,L=San Jose,ST=California,C=US

Serial Number

04:a2:f9:c9:b3:66:09:c6:b0:b3:7e:67:4b:9b:a1:c6

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 13, 2025 - Feb 27, 2028

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:03:32:e1:65:bf:9b:78:43:e0:99:75:94:63:77:0b

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 11, 2025 - Dec 10, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

69808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

CiscoCollabHost.pdb

shlwapi

StrCmpNIW StrCmpIW PathIsDirectoryW PathFileExistsW PathRemoveFileSpecW

crypt32

CertFreeCertificateContext CertGetNameStringW CryptVerifyMessageSignature

imagehlp

ImageGetCertificateHeader ImageEnumerateCertificates ImageGetCertificateData

wintrust

WinVerifyTrust

kernel32

GetConsoleOutputCP FlushFileBuffers SetFilePointerEx HeapSize GetProcessHeap SetStdHandle GetCommandLineW CreateDirectoryW GetLastError ExitProcess FreeLibrary GetProcAddress LocalFree lstrlenW SetDllDirectoryW GetConsoleMode WriteFile CloseHandle GetSystemTime GetTimeFormatEx GetDateFormatEx GetModuleFileNameW DecodePointer InitializeCriticalSectionEx DeleteCriticalSection LoadLibraryExW SetLastError FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW WriteConsoleW CreateFileW UnhandledExceptionFilter WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW OutputDebugStringW RaiseException RtlPcToFileHeader RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree QueryPerformanceFrequency GetStdHandle GetModuleHandleExW HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW

shell32

SHGetKnownFolderPath CommandLineToArgvW

ole32

CoTaskMemFree

advapi32

RegCloseKey RegGetValueW GetUserNameW RegOpenKeyExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-10_e3c776dcca21feb1b75b184fac0c1c91_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

shlwapi

crypt32

imagehlp

wintrust

kernel32

shell32

ole32

advapi32

generic