2026-07-12_6d98d60fe99a949e3190d61cff55cf13_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

General

Target
2026-07-12_6d98d60fe99a949e3190d61cff55cf13_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 632KB
Sample260712-p3dkqsas3k
SHA256 cc8b058e850e53ca7d860a3d52181f1157007b8f6639a98be6424f380d90708a
MD5 6d98d60fe99a949e3190d61cff55cf13
SHA1 72fbae33178fa0f46154777d65d82cc6dd0561be
SHA512 eb4ee1ffd8bbf60b8e217ebff7fcc0c4756f0eb7da33e2bdc326c54f2c2ad34ae44792e13ba5d5d3d64b1acd76572d6de7b3dbf07906fde99d44a7875cf40e12
SSDEEP 6144:1RC73KwQhMICsEzdGR+xQvVgEBYd0iKQPqv+PSZ++HlyV+WlnJXdbCuSnF683+rz:1cVQ2QEzcR+xQqgmSIslyFlJNmH3+rt
TLSH
T1FBD46B66F3A414F8E5B7D278C9660942E772BC150760DBCF13A0466A2F23BD09E3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables Discord URL observed in first stage droppers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_DiscordURL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-12_6d98d60fe99a949e3190d61cff55cf13_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-12_6d98d60fe99a949e3190d61cff55cf13_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 632KB

2026-07-12_6d98d60fe99a949e3190d61cff55cf13_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 7be8e10012ee84b2c595d14cb731eea0
SHA256 cc8b058e850e53ca7d860a3d52181f1157007b8f6639a98be6424f380d90708a
MD5 6d98d60fe99a949e3190d61cff55cf13
SHA1 72fbae33178fa0f46154777d65d82cc6dd0561be
SHA512 eb4ee1ffd8bbf60b8e217ebff7fcc0c4756f0eb7da33e2bdc326c54f2c2ad34ae44792e13ba5d5d3d64b1acd76572d6de7b3dbf07906fde99d44a7875cf40e12
SSDEEP 6144:1RC73KwQhMICsEzdGR+xQvVgEBYd0iKQPqv+PSZ++HlyV+WlnJXdbCuSnF683+rz:1cVQ2QEzcR+xQqgmSIslyFlJNmH3+rt
TLSH
T1FBD46B66F3A414F8E5B7D278C9660942E772BC150760DBCF13A0466A2F23BD09E3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables Discord URL observed in first stage droppers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

520192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetConsoleTitleA MultiByteToWideChar Sleep GetLastError SetConsoleOutputCP SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI CloseHandle GetModuleHandleW GetProcAddress GetFileInformationByHandleEx WideCharToMultiByte LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapReAlloc WaitForSingleObject GetExitCodeProcess CreateProcessW ReadFile ReadConsoleW IsValidCodePage GetACP RtlUnwind

winhttp

WinHttpReadData WinHttpOpenRequest WinHttpReceiveResponse WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpCloseHandle WinHttpOpen

Name

.text

Size

236KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

150KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd003

Size

124KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_6d98d60fe99a949e3190d61cff55cf13_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

winhttp

generic