2026-07-06_a17f8fe3cb742be7f578317e109889fb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

General

Target
2026-07-06_a17f8fe3cb742be7f578317e109889fb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 1.0MB
Sample260707-cap2vacx3j
SHA256 42c711cdc651b91bfe5ea5f67e7ea81b2e4ccfa9b36318f012168c30e68fa79d
MD5 a17f8fe3cb742be7f578317e109889fb
SHA1 966e9f2fab246f2e8d3565e2b080c882ff4251a7
SHA512 cf1faac47ddf7d38f3ab63418938ffcb8b9dbd8aaa64b359d0eb680c7897226affba7b2a73c8d3b5b92d4eac5d5eaa0738694468bbc22843a4503b615b03d7d5
SSDEEP 24576:Ro6NUNeL1u/Uj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+6NXxLNiXicJFFRGNzj3
TLSH
T17935E09663D503F1E0B7D139CA658A45F6B2BC184720A7C703E496762F276E24E3F326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_a17f8fe3cb742be7f578317e109889fb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-07-06_a17f8fe3cb742be7f578317e109889fb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 1.0MB

2026-07-06_a17f8fe3cb742be7f578317e109889fb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 9527b1d1e24954966bd65bc1b37717c5
SHA256 42c711cdc651b91bfe5ea5f67e7ea81b2e4ccfa9b36318f012168c30e68fa79d
MD5 a17f8fe3cb742be7f578317e109889fb
SHA1 966e9f2fab246f2e8d3565e2b080c882ff4251a7
SHA512 cf1faac47ddf7d38f3ab63418938ffcb8b9dbd8aaa64b359d0eb680c7897226affba7b2a73c8d3b5b92d4eac5d5eaa0738694468bbc22843a4503b615b03d7d5
SSDEEP 24576:Ro6NUNeL1u/Uj/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:+6NXxLNiXicJFFRGNzj3
TLSH
T17935E09663D503F1E0B7D139CA658A45F6B2BC184720A7C703E496762F276E24E3F326
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\mtk25642\Downloads\bf84431\x64\Release\mtkbtsvc.pdb

bluetoothapis

BluetoothFindFirstRadio BluetoothFindRadioClose

kernel32

WaitForMultipleObjects SetEvent DeviceIoControl HeapFree GetLastError GetCurrentProcess CreateFileA OutputDebugStringA CreateEventA ResetEvent GetProcessHeap HeapAlloc GetModuleFileNameA CloseHandle WriteConsoleW CreateFileW ReadConsoleW ReadFile HeapReAlloc HeapSize RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetCurrentThread GetFileType GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber InitializeCriticalSectionEx VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW SetConsoleCtrlHandler GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode RtlUnwind

advapi32

RegCreateKeyExA LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken StartServiceCtrlDispatcherA SetServiceStatus RegisterServiceCtrlHandlerA OpenSCManagerA CreateServiceA CloseServiceHandle ChangeServiceConfig2A ReportEventA RegisterEventSourceA DeregisterEventSource RegSetValueExA RegQueryValueExA RegOpenKeyExA RegNotifyChangeKeyValue RegCloseKey

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetClassDevsA SetupDiGetDeviceRegistryPropertyA

Name

.text

Size

384KB

Virtual Size

384KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_a17f8fe3cb742be7f578317e109889fb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

bluetoothapis

kernel32

advapi32

setupapi

generic