2026-06-01_7d8d96e39f1b35b8dd657efbf3dd3d33_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

General

Target
2026-06-01_7d8d96e39f1b35b8dd657efbf3dd3d33_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 2.7MB
Sample260601-es6tesev3k
SHA256 876880ca450f63796fee900b95094e86444eba1645bb8dc04dd28f2408469fe9
MD5 7d8d96e39f1b35b8dd657efbf3dd3d33
SHA1 1547d584d47c8b8cfd2e36164246f95a180ee4df
SHA512 5ea298fbb59ab7ee4c7e30c96052a7de1f6ccac8bce606317acff9a3c576453e68747dd4e888120e158895ed861e6cd7f581fe3e25ca00275df4ed2c2d3b6bc1
SSDEEP 49152:/1XWR1y5iqD3m8TqBSczdypz3d6B9I1x7tLCJQOJF9A8OIQxh:9XWRYgqi8TZczWRlBtMFK8O9j
TLSH
T1E8D523A6A7B408F1EC9B967DC9424602FE72BC171760D6AF57A4C10E2F37AA09D3C711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-06-01_7d8d96e39f1b35b8dd657efbf3dd3d33_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 2.7MB

2026-06-01_7d8d96e39f1b35b8dd657efbf3dd3d33_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 1b8228588b13615766448489c5655246
SHA256 876880ca450f63796fee900b95094e86444eba1645bb8dc04dd28f2408469fe9
MD5 7d8d96e39f1b35b8dd657efbf3dd3d33
SHA1 1547d584d47c8b8cfd2e36164246f95a180ee4df
SHA512 5ea298fbb59ab7ee4c7e30c96052a7de1f6ccac8bce606317acff9a3c576453e68747dd4e888120e158895ed861e6cd7f581fe3e25ca00275df4ed2c2d3b6bc1
SSDEEP 49152:/1XWR1y5iqD3m8TqBSczdypz3d6B9I1x7tLCJQOJF9A8OIQxh:9XWRYgqi8TZczWRlBtMFK8O9j
TLSH
T1E8D523A6A7B408F1EC9B967DC9424602FE72BC171760D6AF57A4C10E2F37AA09D3C711
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

4d:51:21:e7:15:ff:1f:91:fe:58:33:df:b6:11:67:92:17:9f:f9:7c:2a:2c:b5:20:79:30:b7:e9:f6:42:1d:24

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 29, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:1c:5d:8c:74:db:aa:a5:db:bc:00:00:00:00:01:1c

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 5, 2026 - Mar 3, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:431A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:1d:4b:c0:92:87:38:85:7e:39:00:01:00:00:02:1d

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

29472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MpAdlStub.pdb

advapi32

UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle TraceMessage EventWriteTransfer LookupPrivilegeValueW SetSecurityDescriptorDacl AdjustTokenPrivileges AllocateAndInitializeSid CopySid RegCloseKey EventUnregister EventRegister OpenThreadToken OpenProcessToken RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW GetTokenInformation GetLengthSid InitializeAcl InitializeSecurityDescriptor CheckTokenMembership FreeSid AddAccessAllowedAce

kernel32

SetErrorMode CloseHandle IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError SetLastError GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentThread GetCurrentThreadId HeapAlloc HeapFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime FreeLibrary GetProcAddress LoadLibraryExW CompareStringW LCMapStringW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW MultiByteToWideChar ExitProcess GetModuleHandleW GetModuleHandleExW GetProcessHeap WideCharToMultiByte HeapSize HeapReAlloc GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RaiseException EncodePointer InitializeCriticalSectionEx ReadFile SetFileAttributesW Sleep GetCommandLineW CreateToolhelp32Snapshot Process32NextW Process32FirstW GetProcessTimes SizeofResource SetFileTime VirtualUnlock SetFilePointer LockResource LoadResource FindResourceW SystemTimeToFileTime GetSystemTime DosDateTimeToFileTime VirtualQuery FlushFileBuffers GetThreadTimes CreateDirectoryW FindFirstFileW GetFileSizeEx FindNextFileW WriteFile ExpandEnvironmentStringsW RemoveDirectoryW SetEnvironmentVariableW FindClose WaitForSingleObject CreateFileW GetFileAttributesW OpenProcess CreateEventW SetEvent WaitForSingleObjectEx DeleteFileW ResetEvent SetFilePointerEx GetModuleFileNameW GetEnvironmentVariableW GetSystemDirectoryW HeapSetInformation GetCurrentDirectoryW CreateProcessW GetExitCodeProcess QueryFullProcessImageNameW GetStdHandle GetCommandLineA FindFirstFileExW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetConsoleOutputCP GetConsoleMode ReadConsoleW SetEndOfFile WriteConsoleW DecodePointer VirtualLock

rpcrt4

UuidCreate

ntdll

RtlNtStatusToDosError NtSetInformationFile RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlGetVersion RtlUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-01_7d8d96e39f1b35b8dd657efbf3dd3d33_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

advapi32

kernel32

rpcrt4

ntdll

generic