2026-07-10_f9a8da6f435630e9e32caca81b0d749e_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_f9a8da6f435630e9e32caca81b0d749e_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar
Size 925KB
Sample260710-l151esh16w
SHA256 d16df67472f5b281204852a97afb069bcd0de83adbe0a12c61f3df0c00a34d0a
MD5 f9a8da6f435630e9e32caca81b0d749e
SHA1 f8421b67862b85a8a9e797a81516b384e9c21c1a
SHA512 f09db9dcf0c1d86b23d69070536949e9cd8a5ac8817bb15766c2ba24dceed679b9f6662b554039c9b3f8ac7940080f65f691d5b434ae1eca7e72b38ead3632e9
SSDEEP 24576:V5vG8T+tfIGI9pZcTy0rtKbqiGGC5SYCc:V5vG8uG9pyW0rKg
TLSH
T17615492DE6A801AAE06A9175EC554706E7B37F05137186CB33A0766A1F376E0CF3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_f9a8da6f435630e9e32caca81b0d749e_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-07-10_f9a8da6f435630e9e32caca81b0d749e_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

.exe 925KB

2026-07-10_f9a8da6f435630e9e32caca81b0d749e_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 0952fc8422e9df4737b41086c55c43d8
SHA256 d16df67472f5b281204852a97afb069bcd0de83adbe0a12c61f3df0c00a34d0a
MD5 f9a8da6f435630e9e32caca81b0d749e
SHA1 f8421b67862b85a8a9e797a81516b384e9c21c1a
SHA512 f09db9dcf0c1d86b23d69070536949e9cd8a5ac8817bb15766c2ba24dceed679b9f6662b554039c9b3f8ac7940080f65f691d5b434ae1eca7e72b38ead3632e9
SSDEEP 24576:V5vG8T+tfIGI9pZcTy0rtKbqiGGC5SYCc:V5vG8uG9pyW0rKg
TLSH
T17615492DE6A801AAE06A9175EC554706E7B37F05137186CB33A0766A1F376E0CF3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

978944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

FCAT_DT_Capture_x64.pdb

kernel32

GetModuleFileNameA SetLastError GetFullPathNameW GetModuleFileNameW LocalAlloc CreateFileW GetFileAttributesW GetSystemDirectoryW GetLastError CloseHandle GetProcAddress LocalFree VerSetConditionMask CreateProcessW GetModuleHandleW FreeLibrary VerifyVersionInfoW LoadLibraryExW CreateDirectoryW SetConsoleCtrlHandler EnterCriticalSection GetCommandLineW SetConsoleTitleA GetCurrentProcess RegisterWaitForSingleObject UnregisterWait OutputDebugStringA LeaveCriticalSection InitializeCriticalSection WaitForSingleObject GetCurrentThreadId FindFirstChangeNotificationW CreateEventW Sleep AttachConsole OutputDebugStringW SetEvent FindCloseChangeNotification QueryPerformanceFrequency ResetEvent GetLocalTime FindNextChangeNotification DeleteCriticalSection GetCurrentProcessId lstrcmpiW QueryPerformanceCounter AllocConsole HeapFree SetDefaultDllDirectories CreateMutexW GetCurrentDirectoryA UnmapViewOfFile SetProcessMitigationPolicy CreateThread HeapAlloc CreateFileMappingA GetProcessHeap lstrcpyW OpenFileMappingA MapViewOfFile MulDiv WritePrivateProfileStringW GetPrivateProfileIntW LoadLibraryExA GetPrivateProfileStringW WaitForMultipleObjects OpenProcess CopyFileW FormatMessageA CreateEventA SetEndOfFile WriteConsoleW HeapSize GetTimeZoneInformation HeapReAlloc SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadFile ReadConsoleW PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleMode SetFilePointerEx RaiseException GetSystemInfo VirtualProtect VirtualQuery RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead MultiByteToWideChar GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI MoveFileExW GetFileInformationByHandleEx WideCharToMultiByte GetStringTypeW TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo RtlUnwindEx RtlPcToFileHeader InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetConsoleCP ExitProcess GetStdHandle WriteFile GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx RtlUnwind

ole32

CoTaskMemFree

shlwapi

PathFileExistsW

bcrypt

BCryptImportKeyPair BCryptVerifySignature BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyKey

Name

.text

Size

569KB

Virtual Size

569KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.zero

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_f9a8da6f435630e9e32caca81b0d749e_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

kernel32

ole32

shlwapi

bcrypt

generic