2026-07-10_321a0bbe9ab081f3e85ca244195837c0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_321a0bbe9ab081f3e85ca244195837c0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.3MB
Sample260710-3115xaav5x
SHA256 f1d481741fdba565f1c56d1b70d37cd4fbe51009b1b61f428f8f1de06ae72cf3
MD5 321a0bbe9ab081f3e85ca244195837c0
SHA1 7865833814d2b9d90b220223346cd2448cb75abf
SHA512 02bb186a50e728fe73a4e88e3b5a2dfb900df313837f0d01ee78881d87e51c9dfca8b28a4115a65658dea4023edbe7c023f97384ab35ba90c1de5f6bf5e2707a
SSDEEP 24576:aZuWCXXPhyaDbOK616rnru0tsWikNDM3g1ONWZ:aZuWCXfhy4bQ6zr/EkND91qE
TLSH
T1BF55D055A6DC02E5D47A8135C5424A75F0B1BC264BA28BDB82B47B6F1F3B6E01F3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_321a0bbe9ab081f3e85ca244195837c0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-10_321a0bbe9ab081f3e85ca244195837c0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.3MB

2026-07-10_321a0bbe9ab081f3e85ca244195837c0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 28d3ad9e7b2dd725df12065a08e1370d
SHA256 f1d481741fdba565f1c56d1b70d37cd4fbe51009b1b61f428f8f1de06ae72cf3
MD5 321a0bbe9ab081f3e85ca244195837c0
SHA1 7865833814d2b9d90b220223346cd2448cb75abf
SHA512 02bb186a50e728fe73a4e88e3b5a2dfb900df313837f0d01ee78881d87e51c9dfca8b28a4115a65658dea4023edbe7c023f97384ab35ba90c1de5f6bf5e2707a
SSDEEP 24576:aZuWCXXPhyaDbOK616rnru0tsWikNDM3g1ONWZ:aZuWCXfhy4bQ6zr/EkND91qE
TLSH
T1BF55D055A6DC02E5D47A8135C5424A75F0B1BC264BA28BDB82B47B6F1F3B6E01F3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

172112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qb\workspace\21461\source\output\dump64\gfxui\EventManager\igfxEM\Release\igfxEM.pdb

kernel32

GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalUnlock GlobalLock GlobalHandle GlobalFree MulDiv lstrcmpW lstrcmpiW MultiByteToWideChar WideCharToMultiByte DeleteFileW FindClose FindFirstFileW FindNextFileW GetExitCodeThread GetTickCount ExpandEnvironmentStringsW SetFileAttributesW GetSystemDirectoryW CreateDirectoryW OpenEventW GetCurrentProcessId ProcessIdToSessionId GetFileAttributesW CreateProcessW LoadLibraryW WTSGetActiveConsoleSessionId GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetSystemDefaultLangID WriteConsoleW SetEndOfFile CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindFirstFileExW FlushFileBuffers GetOEMCP GetACP IsValidCodePage GetFileSizeEx FindResourceExW SetFilePointerEx ReadConsoleW GetConsoleMode GetTimeZoneInformation GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleHandleExW ExitProcess WriteFile GetStdHandle ReadFile VirtualQuery VirtualProtect GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc RtlPcToFileHeader RtlUnwindEx GetCPInfo LCMapStringEx GetStringTypeW LocalFree GetStartupInfoW GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent GetCurrentThreadId CreateThread Sleep CreateEventW CreateMutexW WaitForSingleObject SetEvent LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc FreeLibrary HeapDestroy DecodePointer SetLastError CloseHandle GetCommandLineW DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException GetConsoleOutputCP RtlUnwind

user32

IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW PostThreadMessageW SendMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW UnregisterClassW GetSystemMetrics GetSubMenu IsChild TrackPopupMenuEx SetMenuDefaultItem SetForegroundWindow GetWindowRect SetWindowContextHelpId MessageBoxW CreateDialogIndirectParamW GetDlgItem CharUpperW GetCursorPos LoadIconW LoadImageW MapDialogRect GetDisplayConfigBufferSizes SetDisplayConfig QueryDisplayConfig DestroyWindow SetWindowPos InsertMenuW MoveWindow CharNextW SetFocus GetFocus SetCapture ReleaseCapture CreateAcceleratorTableW DestroyAcceleratorTable GetDC ReleaseDC BeginPaint EndPaint InvalidateRect InvalidateRgn ClientToScreen RedrawWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW KillTimer SetTimer MapVirtualKeyExW GetKeyNameTextW SendDlgItemMessageW EndDialog CreateDialogParamW IsWindowVisible ShowWindow PostQuitMessage UnregisterDeviceNotification RegisterDeviceNotificationW UnregisterHotKey RegisterHotKey GetKeyboardLayout GetKeyboardLayoutList ActivateKeyboardLayout LoadKeyboardLayoutW MsgWaitForMultipleObjects PeekMessageW FindWindowW DestroyMenu CreatePopupMenu PostMessageW LoadCursorW GetWindow GetClassNameW GetParent GetDesktopWindow SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW GetWindowLongW FillRect GetSysColor ScreenToClient GetClientRect

gdi32

GetObjectW BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps SelectObject GetStockObject

advapi32

RegDeleteKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumKeyExW

ole32

CLSIDFromString OleLockRunning OleRun OleUninitialize OleInitialize CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CLSIDFromProgID CoInitializeEx CoCreateInstance CoReleaseServerProcess CoAddRefServerProcess CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoGetClassObject CoUninitialize CreateStreamOnHGlobal

oleaut32

SysAllocStringLen SysStringLen VariantInit VariantClear VarUI4FromStr LoadTypeLi SysAllocString RegisterTypeLi UnRegisterTypeLi OleCreateFontIndirect SysStringByteLen SysAllocStringByteLen LoadRegTypeLi GetErrorInfo SysFreeString

setupapi

SetupDiCreateDeviceInfoList SetupDiGetClassDevsW SetupDiGetDevicePropertyW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiOpenDeviceInfoW SetupDiOpenDevRegKey

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

shell32

Shell_NotifyIconW SHCreateItemFromParsingName

shlwapi

StrStrW

bcrypt

BCryptHashData BCryptCreateHash BCryptFinishHash BCryptDestroyHash BCryptDecrypt BCryptEncrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider BCryptDestroyKey

version

GetFileVersionInfoSizeExW VerQueryValueW GetFileVersionInfoExW

Name

.text

Size

393KB

Virtual Size

392KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

141KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

148KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_321a0bbe9ab081f3e85ca244195837c0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

gdi32

advapi32

ole32

oleaut32

setupapi

wtsapi32

shell32

shlwapi

bcrypt

version

generic