2026-07-05_fe2320d50a42a31764738e10779e7d26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_fe2320d50a42a31764738e10779e7d26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 10.1MB
Sample260705-bctx5sbv2k
SHA256 e2b540d0fd63ec2699958ca3f54249c980813c1fd8d2151582dd9d5a3bda1b75
MD5 fe2320d50a42a31764738e10779e7d26
SHA1 21cd1035c95672c2aeec436ff33735b073f63deb
SHA512 1380b20a76adf123b91fea9f3e55cd70fffd735cdad3b39b5f7d83feea872e7f2d2f0bdaa77cac4055fb03cb3645995b6dc2ebb26f225b684104ff9458c8138a
SSDEEP 98304:mr+zHTOSxeo/Y7mgTm05AwJHE6hhLxhQY2M7y1ejLxhQY2M7y1eAt:mrYHRxvg7PAmkch37fh37mt
TLSH
T10DB66B1AE2402D9DE5E9D039986F734260F5315B4EA4BC5B334D0E0CAF7E26C1A7B74A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_fe2320d50a42a31764738e10779e7d26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-05_fe2320d50a42a31764738e10779e7d26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 10.1MB

2026-07-05_fe2320d50a42a31764738e10779e7d26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 97ec4a8fcd8bf2306fc3e731bcb96511
SHA256 e2b540d0fd63ec2699958ca3f54249c980813c1fd8d2151582dd9d5a3bda1b75
MD5 fe2320d50a42a31764738e10779e7d26
SHA1 21cd1035c95672c2aeec436ff33735b073f63deb
SHA512 1380b20a76adf123b91fea9f3e55cd70fffd735cdad3b39b5f7d83feea872e7f2d2f0bdaa77cac4055fb03cb3645995b6dc2ebb26f225b684104ff9458c8138a
SSDEEP 98304:mr+zHTOSxeo/Y7mgTm05AwJHE6hhLxhQY2M7y1ejLxhQY2M7y1eAt:mrYHRxvg7PAmkch37fh37mt
TLSH
T10DB66B1AE2402D9DE5E9D039986F734260F5315B4EA4BC5B334D0E0CAF7E26C1A7B74A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

761952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

socket setsockopt send recv ntohs htons getsockname connect closesocket bind WSAStartup inet_pton WSAGetLastError WSACleanup

user32

PostMessageW DefWindowProcW PostQuitMessage UnregisterClassW SendMessageW PeekMessageW DispatchMessageW RegisterClassExW CreateWindowExW DestroyWindow UnregisterHotKey LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos IsWindowUnicode SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard ReleaseCapture GetActiveWindow GetAsyncKeyState ShowWindow RegisterHotKey LoadIconW LoadCursorW GetWindowThreadProcessId SetWindowLongPtrW GetWindowLongPtrW GetWindowRect GetClientRect GetForegroundWindow UpdateWindow GetSystemMetrics SetWindowPos SetLayeredWindowAttributes TranslateMessage

d3d11

D3D11CreateDeviceAndSwapChain

shell32

ShellExecuteW CommandLineToArgvW

dwmapi

DwmSetWindowAttribute

ole32

CoCreateInstance CoInitializeEx

kernel32

IsValidCodePage HeapReAlloc OutputDebugStringW ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetOEMCP SetEnvironmentVariableW WriteFile ExitProcess ReadFile WriteConsoleW GetFileType GetStdHandle LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx GetProcessHeap SetStdHandle GetACP GetCommandLineA GetEnvironmentStringsW HeapFree FreeEnvironmentStringsW InitializeSListHead TerminateProcess GetCurrentProcess HeapSize SetEndOfFile HeapAlloc SleepConditionVariableSRW GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer GetCommandLineW GetEnvironmentVariableW GetFileAttributesExW CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcessId CreateRemoteThread GetExitCodeThread OpenProcess GetSystemTime GetSystemTimeAsFileTime GetTickCount64 VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LocalFree MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLocalTime OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA IsDBCSLeadByte RtlPcToFileHeader RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WakeAllConditionVariable RtlUnwind FormatMessageA GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle GetTempPathW AreFileApisANSI CopyFileW MoveFileExW GetFileInformationByHandleEx FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

Name

.text

Size

977KB

Virtual Size

977KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

276KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8.8MB

Virtual Size

8.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_fe2320d50a42a31764738e10779e7d26_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

ws2_32

user32

d3d11

shell32

dwmapi

ole32

kernel32

imm32

d3dcompiler_47

generic