2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 919KB
Sample260701-lbbqaacx5v
SHA256 2e6f05cef4d9148fc7fb869a9f23be93c93af2470093a3a0c6e2b2df7cbf93ba
MD5 7af6f7acfa1258be4ed6a24c39920236
SHA1 da5a0386928269520f092cc5cdfe07f563ee4f65
SHA512 5229625cc1bf832f3290e6f588ee02726789e6bedc2afa83558715fc56869628a5f87b77587c7e1d1fb633c027e0753f6b21b7583c10e0112d6255f63e7c813b
SSDEEP 24576:pEIU58bVMKEz5CYtByxknw4FYnshx8OfVe247:pxQoXEC3x4x8EVep
TLSH
T1EA150159F7A904F8E1BB9139C9664606E772BC56037097CF23E4461A2F33AE05D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 919KB

2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 534a1143bd7c6d9f0c98f18367c5e20f
SHA256 2e6f05cef4d9148fc7fb869a9f23be93c93af2470093a3a0c6e2b2df7cbf93ba
MD5 7af6f7acfa1258be4ed6a24c39920236
SHA1 da5a0386928269520f092cc5cdfe07f563ee4f65
SHA512 5229625cc1bf832f3290e6f588ee02726789e6bedc2afa83558715fc56869628a5f87b77587c7e1d1fb633c027e0753f6b21b7583c10e0112d6255f63e7c813b
SSDEEP 24576:pEIU58bVMKEz5CYtByxknw4FYnshx8OfVe247:pxQoXEC3x4x8EVep
TLSH
T1EA150159F7A904F8E1BB9139C9664606E772BC56037097CF23E4461A2F33AE05D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

98872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\pc\other_tools\driverinstaller\InfInstaller\x64\Release\InfInstallerx64.pdb

kernel32

LocalAlloc GetModuleHandleA Sleep CopyFileA GetLastError GetFileAttributesA DeleteFileA WaitForSingleObject GetSystemInfo GetProcAddress LocalFree RemoveDirectoryA CreateProcessA CreateDirectoryA GetPrivateProfileStringA SetEndOfFile PeekNamedPipe CreatePipe CloseHandle ReadFile WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW GetFileAttributesExW WideCharToMultiByte MultiByteToWideChar LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW FindClose FindFirstFileExW FindNextFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapReAlloc RtlUnwind

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

shlwapi

PathFileExistsA

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo CM_Locate_DevNodeA SetupDiBuildDriverInfoList SetupDiGetDriverInfoDetailA SetupUninstallOEMInfA SetupDiEnumDriverInfoA CM_Reenumerate_DevNode SetupDiGetClassDevsA SetupDiGetClassDevsExA

newdev

DiUninstallDevice

Name

.text

Size

247KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

936B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-01_7af6f7acfa1258be4ed6a24c39920236_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

advapi32

shlwapi

setupapi

newdev

generic