2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.4MB
Sample260709-cryqbacy3t
SHA256 3338f609c641d501d76faf41afbb758866346e31e6114f5feee54fb32078cd0a
MD5 3b360913f7e720b518262351cba96875
SHA1 95884aa4565a01e06133c1a49a1f977260762fee
SHA512 66e6e73ffb887d865d778396125f67495d0ac62bdcb329e80739db4ed3ba60149130be4af9c501e2373b0290b1def078dc323537f782c19fad4b2ea1549c16fe
SSDEEP 12288:yRo4vrWDIvlN9lPlC5z634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9D:gWDIv3BCvSnnrFb4PM4MYgLxEVyGLV
TLSH
T1A965015973E808F9EDB79778C9B45606DB727C129B30E64F13A0455A2F33690CD3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.4MB

2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH b90273415271d9e95441b930bd78c618
SHA256 3338f609c641d501d76faf41afbb758866346e31e6114f5feee54fb32078cd0a
MD5 3b360913f7e720b518262351cba96875
SHA1 95884aa4565a01e06133c1a49a1f977260762fee
SHA512 66e6e73ffb887d865d778396125f67495d0ac62bdcb329e80739db4ed3ba60149130be4af9c501e2373b0290b1def078dc323537f782c19fad4b2ea1549c16fe
SSDEEP 12288:yRo4vrWDIvlN9lPlC5z634XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9D:gWDIv3BCvSnnrFb4PM4MYgLxEVyGLV
TLSH
T1A965015973E808F9EDB79778C9B45606DB727C129B30E64F13A0455A2F33690CD3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\1\s\pslist\x64\Release\pslist64.pdb

mpr

WNetCancelConnection2A WNetAddConnection2A

version

GetFileVersionInfoSizeA VerQueryValueA GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW GetFileVersionInfoA

kernel32

GetProcAddress LocalAlloc LocalFree GetModuleFileNameA GetModuleFileNameW WriteFile CloseHandle GetLastError Sleep GetCurrentProcess FreeLibrary GetModuleHandleA GetCommandLineW FormatMessageA WideCharToMultiByte GetConsoleScreenBufferInfo lstrlenA IsBadStringPtrA FileTimeToLocalFileTime SetPriorityClass GetSystemTimeAsFileTime GetComputerNameExA FileTimeToSystemTime GetDateFormatA GetTimeFormatA SetConsoleCtrlHandler FillConsoleOutputCharacterA SetConsoleCursorPosition SetFilePointerEx GetFileType GetStdHandle LoadLibraryExA GetVersionExA SetLastError GetStringTypeW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize HeapReAlloc WriteConsoleW RaiseException GetSystemInfo VirtualProtect VirtualQuery GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwindEx RtlPcToFileHeader EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RtlUnwind ExitProcess GetModuleHandleExW GetConsoleCP SetStdHandle CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetCommandLineA HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW CreateFileW GetConsoleMode SetConsoleMode ReadConsoleInputW FlushFileBuffers GetConsoleOutputCP ReadFile GetFileSizeEx

comdlg32

PrintDlgA

advapi32

RegConnectRegistryA LogonUserA RevertToSelf ImpersonateLoggedOnUser RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExA RegOpenKeyA RegCreateKeyA RegCloseKey

Name

.text

Size

150KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_3b360913f7e720b518262351cba96875_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

mpr

version

kernel32

comdlg32

advapi32

generic