2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.4MB
Sample260709-cftbfscw5y
SHA256 2f971a6b78d88d10d7f7352554f7cbc15409575c817b70112148dd031d691ad4
MD5 9b680ef3f15770c73c4f665a341e4294
SHA1 5c2dd8a37c3d7f6764ede31d70870c3668e8d7ca
SHA512 32e6eddf9456e8f892161c6b08b559deac6d6cda9b6d3e72e66fe85b5a9e8ddb81cfad90f303c5f15be46fcbe63f893da498332d3139997a0829cd68b9da2bf6
SSDEEP 12288:Ikn9Lp/1qEqHVRzPo5Y34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r4:J9Lp/1DqbMSnnrFb4PM4MYgLxEVyGLW
TLSH
T19665F15533E908F9EDF7663489719645EB32BC529B34E66F0390811A1F37A80DD3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.4MB

2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 368e6f75b2cd054e7534d8ac445f391a
SHA256 2f971a6b78d88d10d7f7352554f7cbc15409575c817b70112148dd031d691ad4
MD5 9b680ef3f15770c73c4f665a341e4294
SHA1 5c2dd8a37c3d7f6764ede31d70870c3668e8d7ca
SHA512 32e6eddf9456e8f892161c6b08b559deac6d6cda9b6d3e72e66fe85b5a9e8ddb81cfad90f303c5f15be46fcbe63f893da498332d3139997a0829cd68b9da2bf6
SSDEEP 12288:Ikn9Lp/1qEqHVRzPo5Y34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r4:J9Lp/1DqbMSnnrFb4PM4MYgLxEVyGLW
TLSH
T19665F15533E908F9EDF7663489719645EB32BC529B34E66F0390811A1F37A80DD3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\1\s\pspasswd\x64\Release\pspasswd64.pdb

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

netapi32

NetGetAnyDCName NetUserSetInfo NetUserGetInfo NetServerEnum NetApiBufferFree

mpr

WNetAddConnection2W WNetCancelConnection2W

kernel32

VerSetConditionMask CreateFileW WriteFile CloseHandle GetCurrentProcess FreeLibrary GetModuleFileNameW GetVersionExW FormatMessageA VerifyVersionInfoW MultiByteToWideChar GetConsoleScreenBufferInfo GetFileSizeEx ReadFile ReadConsoleW ReadConsoleInputW SetConsoleMode GetConsoleMode GetConsoleOutputCP FlushFileBuffers LocalFree LocalAlloc GetProcAddress GetModuleHandleW GetFileType GetStdHandle GetCommandLineW LoadLibraryExW SetLastError GetComputerNameW GetLastError SetFilePointerEx HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW HeapSize SetEndOfFile WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree RtlUnwind ExitProcess GetModuleHandleExW GetConsoleCP SetStdHandle GetCommandLineA HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW

user32

DialogBoxIndirectParamW EndDialog GetDlgItem SetWindowTextW LoadCursorW InflateRect GetSysColorBrush SetCursor SendMessageW

gdi32

StartPage EndDoc StartDocW SetMapMode GetDeviceCaps EndPage

comdlg32

PrintDlgW

advapi32

RegSetValueExW RegQueryValueExW RegOpenKeyExW RegOpenKeyW RegCreateKeyW RegCloseKey

Name

.text

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_9b680ef3f15770c73c4f665a341e4294_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

version

netapi32

mpr

kernel32

user32

gdi32

comdlg32

advapi32

generic