2026-06-26_d20614fedb0931ac2dac53a5add1da37_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-26_d20614fedb0931ac2dac53a5add1da37_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar
Size 428KB
Sample260629-n9ewpsev3n
SHA256 bccc9fae22d63a6e7919f618499c3caaefafd54e5b475ef85fecf1af3290b96c
MD5 d20614fedb0931ac2dac53a5add1da37
SHA1 3bbe28509de346f87b6617927bd0b0978eb39f34
SHA512 f2222464601d418fd06fe147463ec5655d7cfae35bc779b5c40d903bd626437e6ba22f44caf39cd7aecd822d08d51e38274bec9eff28d2265887e60d790ad4fb
SSDEEP 12288:z/I2Ovl1SYfPQFtLADKX1ZQP6er0bWMbrbXQxbDQRbTPrbGb4mb4eFrbvblb/uPJ:z/4d1SQQFZWKr
TLSH
T1F1949E59F7A500F9D0A39278CE574643E772780A03B0DB9F279C56662F133A0AE3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-26_d20614fedb0931ac2dac53a5add1da37_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-06-26_d20614fedb0931ac2dac53a5add1da37_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

.exe 428KB

2026-06-26_d20614fedb0931ac2dac53a5add1da37_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 051d0638b81486a50e4faf95ffaf6194
SHA256 bccc9fae22d63a6e7919f618499c3caaefafd54e5b475ef85fecf1af3290b96c
MD5 d20614fedb0931ac2dac53a5add1da37
SHA1 3bbe28509de346f87b6617927bd0b0978eb39f34
SHA512 f2222464601d418fd06fe147463ec5655d7cfae35bc779b5c40d903bd626437e6ba22f44caf39cd7aecd822d08d51e38274bec9eff28d2265887e60d790ad4fb
SSDEEP 12288:z/I2Ovl1SYfPQFtLADKX1ZQP6er0bWMbrbXQxbDQRbTPrbGb4mb4eFrbvblb/uPJ:z/4d1SQQFZWKr
TLSH
T1F1949E59F7A500F9D0A39278CE574643E772780A03B0DB9F279C56662F133A0AE3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

104736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpOpenRequest WinHttpQueryOption

bcrypt

BCryptGenRandom BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptEncrypt

iphlpapi

GetAdaptersInfo

dwmapi

DwmSetWindowAttribute

crypt32

CertGetCertificateChain CryptEncodeObjectEx CertFreeCertificateChain CertFreeCertificateContext

user32

GetClientRect SetForegroundWindow TranslateMessage SetFocus GetForegroundWindow ReleaseCapture UpdateWindow LoadCursorW PostQuitMessage AttachThreadInput GetWindowThreadProcessId GetMessageW DefWindowProcW PostMessageW DestroyWindow SetWindowPos CreateWindowExW GetSystemMetrics RegisterClassExW ShowWindow DispatchMessageW MessageBoxW

gdi32

CreateSolidBrush

shell32

SHCreateDirectoryExW ShellExecuteW

ole32

CoInitializeEx CoTaskMemFree CoUninitialize CoTaskMemAlloc

advapi32

EventUnregister EventWriteTransfer EventSetInformation EventRegister RegCloseKey RegOpenKeyExW RegQueryValueExW RegGetValueW

kernel32

GetFileSizeEx FindFirstFileExW SetFilePointerEx IsValidCodePage LCMapStringW GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW GetFileType HeapAlloc GetCommandLineW GetCommandLineA GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer SetLastError CompareStringW SetStdHandle RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent CreateEventW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc SetEndOfFile ReadConsoleW GetTimeZoneInformation GetTickCount GetCurrentProcess TerminateProcess GetModuleFileNameW CreateMutexW ReleaseMutex GetLastError CloseHandle OpenMutexW MoveFileW WriteFile GetTempPathW CreateFileW DeleteFileW ExitProcess GetCurrentProcessId CreateProcessW WideCharToMultiByte MultiByteToWideChar GetSystemFirmwareTable GetVolumeInformationW ReadFile SizeofResource FindFirstFileW SetHandleInformation FindNextFileW ExpandEnvironmentStringsW InitializeProcThreadAttributeList CreatePipe FindClose GetCurrentThreadId SetFileAttributesW Sleep UpdateProcThreadAttribute LockResource FreeConsole LoadResource DeleteProcThreadAttributeList FindResourceW GetModuleHandleW GetConsoleWindow GetCurrentThread GetThreadContext VirtualProtect AddVectoredExceptionHandler GetProcAddress CreateToolhelp32Snapshot Process32NextW Process32FirstW FlushInstructionCache GetModuleHandleA WriteConsoleW GetTickCount64 QueryPerformanceCounter GetFileAttributesW OutputDebugStringA OutputDebugStringW GetProcessHeap HeapFree LoadLibraryExW LoadLibraryW FreeLibrary GetEnvironmentVariableW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent SetUnhandledExceptionFilter QueryPerformanceFrequency InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection UnhandledExceptionFilter

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

Name

.text

Size

254KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.hwxc

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-26_d20614fedb0931ac2dac53a5add1da37_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

winhttp

bcrypt

iphlpapi

dwmapi

crypt32

user32

gdi32

shell32

ole32

advapi32

kernel32

ntdll

generic