2026-07-08_f1187cfda395cd06532209575826bf22_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-08_f1187cfda395cd06532209575826bf22_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 211KB
Sample260708-tz34facv2m
SHA256 49a1ab9522e3d88afd49a1de5c80526bd1b0567506895557772a089692e1a94d
MD5 f1187cfda395cd06532209575826bf22
SHA1 f3324419a34d44bd1e7aa269c7b52d27881ad15b
SHA512 d00149c86fd30fe67b0bff05e7f46c2cf801dbee0b1d1d8c0537ae0f015d74aa052de503dd70a21dd2d27f298d345c417499d2726616d068710e91309aeaa796
SSDEEP 3072:OCtt5hRH9IRVY/tq0G+pgEA43r4/pKvWB5SZBzPwSEZlaZ5Le15JW:OCtt52i/Q0G+OEAIEBGWuYSEAe1K
TLSH
T190247A0473A708F9E9B3927D8A62C687D6B238550B20DADF03B04662EF372D05D3E756
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_f1187cfda395cd06532209575826bf22_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-07-08_f1187cfda395cd06532209575826bf22_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 211KB

2026-07-08_f1187cfda395cd06532209575826bf22_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 092b78b59b805664069b3ee391aa9b82
SHA256 49a1ab9522e3d88afd49a1de5c80526bd1b0567506895557772a089692e1a94d
MD5 f1187cfda395cd06532209575826bf22
SHA1 f3324419a34d44bd1e7aa269c7b52d27881ad15b
SHA512 d00149c86fd30fe67b0bff05e7f46c2cf801dbee0b1d1d8c0537ae0f015d74aa052de503dd70a21dd2d27f298d345c417499d2726616d068710e91309aeaa796
SSDEEP 3072:OCtt5hRH9IRVY/tq0G+pgEA43r4/pKvWB5SZBzPwSEZlaZ5Le15JW:OCtt52i/Q0G+OEAIEBGWuYSEAe1K
TLSH
T190247A0473A708F9E9B3927D8A62C687D6B238550B20DADF03B04662EF372D05D3E756
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ShitAGiyaN\Desktop\q\XorDebug4\x64\Release\Runtime Broker.pdb

ws2_32

send WSACleanup getaddrinfo closesocket select ntohl shutdown WSAStartup WSAGetLastError setsockopt freeaddrinfo htons inet_ntop htonl recv gethostname connect socket inet_pton

gdiplus

GdipSaveImageToStream GdipGetImageEncodersSize GdiplusStartup GdipCreateBitmapFromHBITMAP GdipGetImageEncoders GdipDisposeImage

ole32

CreateStreamOnHGlobal CoInitializeEx CoUninitialize GetHGlobalFromStream

kernel32

FlsGetValue FlsAlloc GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA ReadFile GetModuleFileNameA GetVolumeInformationW GetLogicalDrives FindFirstFileW GetFileSizeEx Process32First SetHandleInformation EnterCriticalSection FindNextFileW WriteFile TerminateProcess LeaveCriticalSection CreatePipe InitializeCriticalSection FindClose CreateMutexA WaitForSingleObject CreateFileW GetModuleHandleA OpenProcess FlsFree MultiByteToWideChar Sleep GetTickCount64 GetLastError K32GetProcessMemoryInfo CreateFileA SetEvent DeleteFileW Process32Next CloseHandle GetNativeSystemInfo CreateThread GetLocalTime GetProcAddress GlobalLock DeleteCriticalSection ExitProcess GetComputerNameW GlobalMemoryStatusEx CreateProcessW WideCharToMultiByte CreateProcessA GetDiskFreeSpaceExA CreateEventA GetTickCount GlobalUnlock GetDriveTypeW FlushFileBuffers GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetFileType InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap FlsSetValue SetFilePointerEx HeapSize HeapReAlloc GetConsoleOutputCP GetConsoleMode WriteConsoleW CreateToolhelp32Snapshot HeapAlloc HeapFree GetModuleHandleExW GetModuleFileNameW GetStdHandle RtlPcToFileHeader RaiseException EncodePointer RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW

user32

ReleaseDC MapVirtualKeyA GetSystemMetrics GetDC SendInput

gdi32

SetBrushOrgEx BitBlt SelectObject CreateCompatibleDC StretchBlt DeleteDC SetStretchBltMode DeleteObject CreateCompatibleBitmap

advapi32

RegQueryInfoKeyA RegCloseKey RegQueryValueExA RegSetValueExA RegEnumKeyExA RegOpenKeyExA RegDeleteValueA GetUserNameW

bcrypt

BCryptDecrypt BCryptEncrypt BCryptOpenAlgorithmProvider BCryptGenRandom BCryptSetProperty BCryptGenerateSymmetricKey

Name

.text

Size

147KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

604KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_f1187cfda395cd06532209575826bf22_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

ws2_32

gdiplus

ole32

kernel32

user32

gdi32

advapi32

bcrypt

generic