2026-07-14_4fef66724d8ed055293e6a7f3a092645_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_4fef66724d8ed055293e6a7f3a092645_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 45.1MB
Sample260714-ejxt6ady5l
SHA256 17efcfedb6075fddb731022d67263888a9aff04c9134cc0f1a198f8751ce1761
MD5 4fef66724d8ed055293e6a7f3a092645
SHA1 731371a6b1a1f1e14c245147933c1f15b053a757
SHA512 e001a85984b942ca042577327bb4d63af5f03e94ed7c243208c8bb60b106d7783bae3f6fa4f6590e34aaf14fc16814bb72f294b0e76a3fe3778a95b52c8c5890
SSDEEP 786432:HtAtOqx19MHZrnKFtUfDkXbAWon9GYMuSxoXM2do7lzT8kEXEq5kXB0WwFIE:y39MHZr3fQX8oYMuSb2dU/YEt0WwFL
TLSH
T1A6A7336562B414F5C1B38376D9949572EF75784E233083EA96A8C62C2F27EE12DBF301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-07-14_4fef66724d8ed055293e6a7f3a092645_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-14_4fef66724d8ed055293e6a7f3a092645_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 45.1MB

2026-07-14_4fef66724d8ed055293e6a7f3a092645_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 9ae9b6de5ba68e97401b9949bc44fde3
SHA256 17efcfedb6075fddb731022d67263888a9aff04c9134cc0f1a198f8751ce1761
MD5 4fef66724d8ed055293e6a7f3a092645
SHA1 731371a6b1a1f1e14c245147933c1f15b053a757
SHA512 e001a85984b942ca042577327bb4d63af5f03e94ed7c243208c8bb60b106d7783bae3f6fa4f6590e34aaf14fc16814bb72f294b0e76a3fe3778a95b52c8c5890
SSDEEP 786432:HtAtOqx19MHZrnKFtUfDkXbAWon9GYMuSxoXM2do7lzT8kEXEq5kXB0WwFIE:y39MHZr3fQX8oYMuSb2dU/YEt0WwFL
TLSH
T1A6A7336562B414F5C1B38376D9949572EF75784E233083EA96A8C62C2F27EE12DBF301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

22:49:df:ea:73:a5:4e:ad:67:43:39:f6:8b:76:24:d5:15:47:c7:0b:37:8b:7e:a2:0d:02:9f:2c:9f:00:cf:65:99:9c:19:35:ab:b9:51:95:f8:2e:c5:7f:ed:9a:66:5c

Digest Algorithm

sha384

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1636032,CN=Intel Corporation,O=Intel Corporation,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

May 25, 2026

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

Serial Number

b4:20:36:f0:d5:c9:06:8c:d9:01:61:89:72:40:19:bd

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 4, 2025 - Sep 4, 2026

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

160064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Windows\Temp\Symbols\SFX.pdb

kernel32

OutputDebugStringA GetModuleFileNameW CreateFileW CloseHandle GetWindowsDirectoryW CreateDirectoryW LoadLibraryW FindResourceW LoadResource LockResource SizeofResource LocalAlloc BeginUpdateResourceW GetModuleFileNameA EndUpdateResourceW LocalFree FreeLibrary CreateProcessW WaitForSingleObject GetExitCodeProcess PeekNamedPipe ReadFile CreatePipe MultiByteToWideChar WideCharToMultiByte GetCurrentProcess LoadLibraryExA GetLocalTime GetCurrentProcessId GetCurrentThreadId GetLastError UpdateResourceW SetDefaultDllDirectories VirtualQuery VirtualProtect GetSystemInfo SetEndOfFile FormatMessageA GetStringTypeW GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle GetTempPathW AreFileApisANSI GetModuleHandleW GetProcAddress CopyFileW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LCMapStringEx GetSystemTimeAsFileTime GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree GetFileType GetFileSizeEx SetFilePointerEx HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadConsoleW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW RtlUnwind

advapi32

OpenProcessToken RegOpenKeyExW RegQueryValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation

ole32

CoCreateGuid StringFromCLSID CoTaskMemFree

Name

.text

Size

322KB

Virtual Size

321KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_4fef66724d8ed055293e6a7f3a092645_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

advapi32

ole32

generic