2026-07-15_81a176b27a71aa469abb74354cce0305_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-15_81a176b27a71aa469abb74354cce0305_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 8.6MB
Sample260715-fbda8aex4w
SHA256 37901c917eec6402189ed51c56949cf35880b90c86489b46caca9d99924787f1
MD5 81a176b27a71aa469abb74354cce0305
SHA1 af4a1c774843277adc8dbcc0e084adefc6fa410d
SHA512 f1723164c907a129286584df8d61ea6c56c99ae2edb7667483eedae6c4d694ad995177ff041f71291876b5707868478a8ede48c582af582b7f44e4f71f4d3c5d
SSDEEP 196608:E9z6TuVIdYGBbuhr7FvkChr7FvkKoj+W4ilQTAI2A:E0TP+IyV+CV+x5v8AI2
TLSH
T121961206E29306A8DF67AB38C8956663C1B07CD447B083DB1B9D0D669FA76F09E7D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-15_81a176b27a71aa469abb74354cce0305_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-15_81a176b27a71aa469abb74354cce0305_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 8.6MB

2026-07-15_81a176b27a71aa469abb74354cce0305_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 9b42d7992dee256a5c6dc09ed1bbcd87
SHA256 37901c917eec6402189ed51c56949cf35880b90c86489b46caca9d99924787f1
MD5 81a176b27a71aa469abb74354cce0305
SHA1 af4a1c774843277adc8dbcc0e084adefc6fa410d
SHA512 f1723164c907a129286584df8d61ea6c56c99ae2edb7667483eedae6c4d694ad995177ff041f71291876b5707868478a8ede48c582af582b7f44e4f71f4d3c5d
SSDEEP 196608:E9z6TuVIdYGBbuhr7FvkChr7FvkKoj+W4ilQTAI2A:E0TP+IyV+CV+x5v8AI2
TLSH
T121961206E29306A8DF67AB38C8956663C1B07CD447B083DB1B9D0D669FA76F09E7D700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

975248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\relax\Music\tcs 2\aa\aa\tcs offi\storm old\storm old\build\Release\Storm.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromFileA D3DX11GetImageInfoFromFileA D3DX11CreateShaderResourceViewFromMemory

wininet

HttpOpenRequestA InternetOpenUrlA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA

kernel32

Process32FirstW CloseHandle Module32FirstW VirtualProtectEx VirtualAllocEx ReadProcessMemory WideCharToMultiByte Module32NextW WaitForSingleObject Sleep CreateRemoteThread GetTickCount GetTickCount64 MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetModuleHandleA GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter CreateMutexA GetLastError ExitProcess WinExec SetConsoleOutputCP GetLocalTime GetModuleHandleW LoadLibraryExW VirtualQueryEx GetExitCodeProcess GetModuleFileNameA GetModuleHandleExA CreateProcessA GetVolumeInformationA GetFileAttributesA CreateDirectoryA GetComputerNameA FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo LCMapStringEx Process32NextW DecodePointer EncodePointer DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionEx CompareStringEx TryAcquireSRWLockExclusive GetStringTypeW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId CreateToolhelp32Snapshot OpenProcess WriteProcessMemory FreeLibrary GetModuleHandleExW GetStdHandle GetFileType RtlUnwind GetModuleFileNameW WriteConsoleW ReadFile WriteFile GetCommandLineA GetProcessHeap CreateFileW HeapSize GetCurrentProcessId IsProcessorFeaturePresent SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW TerminateProcess GetCurrentProcess GetProcAddress LoadLibraryA SetEndOfFile FindFirstFileExW FindClose OutputDebugStringW ReadConsoleW HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapAlloc SetFilePointerEx GetFileSizeEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCommandLineW

user32

SetForegroundWindow GetWindowLongW SetWindowLongA GetWindowRect GetWindowThreadProcessId GetWindowTextLengthW EnumWindows GetWindowTextW DefWindowProcW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW MapWindowPoints MoveWindow SetLayeredWindowAttributes LoadIconW GetParent EnumDisplayMonitors MessageBoxA GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData SendInput SetWindowPos ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW SetWindowDisplayAffinity TranslateMessage SetWindowLongW GetClientRect UpdateWindow

comdlg32

GetOpenFileNameA

advapi32

CryptGetHashParam CryptReleaseContext RegOpenKeyExA RegCloseKey CryptAcquireContextW RegQueryValueExA GetUserNameA CryptCreateHash CryptHashData CryptDestroyHash

shell32

SHGetFolderPathA

ole32

CoInitialize

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry NtReadVirtualMemory RtlCaptureContext NtWriteVirtualMemory

winmm

mciSendStringA

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

gdiplus

GdipDisposeImage GdipGraphicsClear GdipFree GdipImageSelectActiveFrame GdipBitmapLockBits GdipAlloc GdipImageGetFrameCount GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImageWidth GdipCreateBitmapFromScan0 GdipGetPropertyItemSize GdipDrawImageRectI GdipGetPropertyItem GdipBitmapUnlockBits GdipCloneImage GdipImageGetFrameDimensionsCount GdipGetImageHeight GdipLoadImageFromFile GdiplusStartup GdipImageGetFrameDimensionsList

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-15_81a176b27a71aa469abb74354cce0305_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

d3d11

d3dx11_43

wininet

kernel32

user32

comdlg32

advapi32

shell32

ole32

ntdll

winmm

imm32

d3dcompiler_43

dwmapi

gdiplus

generic