2026-07-09_11f0ca2e5b0b125bb9ef7898bb5c8b6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_11f0ca2e5b0b125bb9ef7898bb5c8b6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 15.4MB
Sample260709-cxcp2acz21
SHA256 21847467ddec1a2f01260b664e246b8458ad5ebf0ce2ddadc0f4b70f6bc317f1
MD5 11f0ca2e5b0b125bb9ef7898bb5c8b6d
SHA1 a11f73efda086fba0bb44c670dda3394bc1391df
SHA512 369d53bb3275c5baf7c8cdd9c6085a2023b7bf4f489caa7d3c165e4ba4124f4ee0f188c89f8609337531fb906b3dd43c8757609efd3b5443207d75391cd8a43e
SSDEEP 196608:97Kg7PAmkeEyg7PAmkeErfzujx8YyLoQK2Z:RPAmkeEzPAmkeE3uij7
TLSH
T130F64AE730C267EDC516C93E8713FEBF868F7035062699F3A068E2665D26C843E55E09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_11f0ca2e5b0b125bb9ef7898bb5c8b6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-09_11f0ca2e5b0b125bb9ef7898bb5c8b6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 15.4MB

2026-07-09_11f0ca2e5b0b125bb9ef7898bb5c8b6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH ef31f45f4428420b135d5b6ca1c61b11
SHA256 21847467ddec1a2f01260b664e246b8458ad5ebf0ce2ddadc0f4b70f6bc317f1
MD5 11f0ca2e5b0b125bb9ef7898bb5c8b6d
SHA1 a11f73efda086fba0bb44c670dda3394bc1391df
SHA512 369d53bb3275c5baf7c8cdd9c6085a2023b7bf4f489caa7d3c165e4ba4124f4ee0f188c89f8609337531fb906b3dd43c8757609efd3b5443207d75391cd8a43e
SSDEEP 196608:97Kg7PAmkeEyg7PAmkeErfzujx8YyLoQK2Z:RPAmkeEzPAmkeE3uij7
TLSH
T130F64AE730C267EDC516C93E8713FEBF868F7035062699F3A068E2665D26C843E55E09
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71588

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FreeLibrary GetModuleFileNameW GetVolumeInformationA LocalAlloc GetModuleHandleA OpenProcess GetLastError GetFileAttributesA FileTimeToSystemTime GetProcessHeap GetWindowsDirectoryA FileTimeToLocalFileTime LocalFree GetProcessTimes SetEndOfFile GetProcAddress HeapAlloc VirtualAlloc VirtualFree SetLastError HeapFree WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage VirtualProtect CloseHandle IsDebuggerPresent FindNextFileW FindFirstFileExW FindClose ReadConsoleW ReadFile GetFileAttributesExW GetExitCodeProcess WaitForSingleObject GetTimeZoneInformation InitializeCriticalSectionEx HeapSize HeapReAlloc DecodePointer DeleteCriticalSection SetUnhandledExceptionFilter DeviceIoControl CreateFileW GetCurrentThreadId GetCurrentProcessId GetTempPathW UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlUnwind GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead EnterCriticalSection LeaveCriticalSection EncodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo OutputDebugStringW RaiseException RtlUnwindEx RtlPcToFileHeader InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW CreateProcessW DeleteFileW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode

advapi32

CryptAcquireContextW RegCloseKey RegDeleteKeyW RegCreateKeyW RegOpenKeyW CryptGetHashParam RegGetValueW RegSetKeyValueW CryptReleaseContext GetCurrentHwProfileA CryptCreateHash CryptHashData CryptDestroyHash

ws2_32

WSAStartup inet_addr inet_ntoa WSACleanup

dnsapi

DnsFree DnsQuery_A

version

VerQueryValueW GetFileVersionInfoExW GetFileVersionInfoSizeExW

ntdll

RtlInitUnicodeString RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind NtQuerySystemInformation

Name

.text

Size

227KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12.7MB

Virtual Size

12.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vlizer

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_11f0ca2e5b0b125bb9ef7898bb5c8b6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

advapi32

ws2_32

dnsapi

version

ntdll

generic