2026-05-28_93a29975d3cc283c8393c8dcb1ff2d09_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-28_93a29975d3cc283c8393c8dcb1ff2d09_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar
Size 1.1MB
Sample260528-mb7ndset6x
SHA256 972005ffdf8d40f29e45623e47af287c1b2fe4f23028ffe0beafd222fa29e4b8
MD5 93a29975d3cc283c8393c8dcb1ff2d09
SHA1 5b0b6f1cdd78816c337979602903059fd7e5f81d
SHA512 de3af135f0dfcbce18a415983c4335f96d91ad47c079d22a090c84c1e04d0c88fa76ef92aa3f35aa0fd94ef3ea3dee0422dd121338ab0cc896a322e54efc6e24
SSDEEP 12288:rn5YovCWAw6nc9+w0VxTALfkw7MXbGPKQljbxUp1PscSbjkPEH:rneovAwuxTALfkOMXb4hlnxUfPsAEH
TLSH
T1EF35AE43F6E641FDD1BB9578C9294357E775B40A03204EEB83E49AA52F13AE84F39342
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_93a29975d3cc283c8393c8dcb1ff2d09_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-05-28_93a29975d3cc283c8393c8dcb1ff2d09_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

.exe 1.1MB

2026-05-28_93a29975d3cc283c8393c8dcb1ff2d09_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 7bf0d9690a578788d19078245816272d
SHA256 972005ffdf8d40f29e45623e47af287c1b2fe4f23028ffe0beafd222fa29e4b8
MD5 93a29975d3cc283c8393c8dcb1ff2d09
SHA1 5b0b6f1cdd78816c337979602903059fd7e5f81d
SHA512 de3af135f0dfcbce18a415983c4335f96d91ad47c079d22a090c84c1e04d0c88fa76ef92aa3f35aa0fd94ef3ea3dee0422dd121338ab0cc896a322e54efc6e24
SSDEEP 12288:rn5YovCWAw6nc9+w0VxTALfkw7MXbGPKQljbxUp1PscSbjkPEH:rneovAwuxTALfkOMXb4hlnxUfPsAEH
TLSH
T1EF35AE43F6E641FDD1BB9578C9294357E775B40A03204EEB83E49AA52F13AE84F39342
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

214448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

TerminateThread GetTickCount64 GetModuleFileNameA GetModuleHandleA SetThreadExecutionState GetPrivateProfileIntA GetPrivateProfileStringA WritePrivateProfileStringA SetConsoleCtrlHandler CreateToolhelp32Snapshot Process32First Process32Next CancelIo GetVersionExA GetNativeSystemInfo DeleteFileA GetFileAttributesA ReadFile SetFileAttributesA CreatePipe GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessA FreeLibrary GetProcAddress LoadLibraryA GetProcessTimes GlobalMemoryStatusEx GetSystemInfo GetModuleHandleW GetCurrentThreadId CreateThread WriteFile DisconnectNamedPipe PeekNamedPipe GetSystemDirectoryA LocalAlloc LocalFree OpenProcess LocalReAlloc LocalSize GetCurrentProcessId SetEndOfFile CreateFileW HeapSize HeapReAlloc GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileAttributesExW GetTimeZoneInformation Sleep CreateEventA CreateMutexA WaitForSingleObject SetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetLastError GetLastError CloseHandle ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc OutputDebugStringW GetEnvironmentVariableA VirtualFree HeapAlloc HeapFree GetCommandLineW GetCommandLineA ExitProcess FreeLibraryAndExitThread lstrlenA VirtualAlloc RtlUnwind ExitThread WriteConsoleW GetModuleHandleExW GetModuleFileNameW GetFileType ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread TryAcquireSRWLockExclusive WakeConditionVariable WideCharToMultiByte InitializeCriticalSectionEx EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo InitializeConditionVariable SleepConditionVariableCS RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle

user32

EnumWindows IsWindowVisible OpenInputDesktop CloseDesktop GetUserObjectInformationA GetLastInputInfo GetForegroundWindow GetWindowTextA GetSystemMetrics PostMessageA ShowWindow

advapi32

FreeSid RegCreateKeyExA RegOpenKeyExA RegQueryValueExA LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken RegOpenKeyA RegCloseKey CheckTokenMembership AllocateAndInitializeSid RegSetValueExA

ws2_32

inet_addr htons connect closesocket WSACleanup WSAGetLastError inet_ntoa inet_pton sendto recvfrom ntohl gethostname getnameinfo recv select WSAStartup setsockopt socket WSAIoctl gethostbyname send

avicap32

capGetDriverDescriptionA

wininet

InternetOpenUrlA InternetCloseHandle InternetOpenA InternetReadFile InternetSetOptionA

iphlpapi

GetAdaptersAddresses

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

psapi

EnumProcessModules GetModuleFileNameExA

Name

.text

Size

909KB

Virtual Size

908KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_93a29975d3cc283c8393c8dcb1ff2d09_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

kernel32

user32

advapi32

ws2_32

avicap32

wininet

iphlpapi

version

psapi

generic