2026-07-19_84918cf47f00fd398a01747933a8595d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_84918cf47f00fd398a01747933a8595d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 732KB
Sample260719-b96cfahs7j
SHA256 fa1178f2ca5000717cda1f8de325e9e14bb7e719eb7ba02fa481b5f2d4b8e736
MD5 84918cf47f00fd398a01747933a8595d
SHA1 c7146636bf4d6eba788881b62a6fad332f9548d7
SHA512 db248d2ac627493750eaaf7c9dd90d973980c200df34f452512b7bd3bf62d118dd6971c9b03490d732036a5ab6b51142ca5588adc36179d2d7dc4cc0fa5b47dd
SSDEEP 12288:IAS+gXHVvPu/yKGSW5Q+T0J5u6Vvseilc5Wu3sCP:AlvPu9u6dse4c0mP
TLSH
T17EF45C17629902FCE0BBE17899565E06E779B80A03B19EDF03D005A72F976E49F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-19_84918cf47f00fd398a01747933a8595d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-07-19_84918cf47f00fd398a01747933a8595d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 732KB

2026-07-19_84918cf47f00fd398a01747933a8595d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 7f76447ef3dafbdd65b89a8177e5f066
SHA256 fa1178f2ca5000717cda1f8de325e9e14bb7e719eb7ba02fa481b5f2d4b8e736
MD5 84918cf47f00fd398a01747933a8595d
SHA1 c7146636bf4d6eba788881b62a6fad332f9548d7
SHA512 db248d2ac627493750eaaf7c9dd90d973980c200df34f452512b7bd3bf62d118dd6971c9b03490d732036a5ab6b51142ca5588adc36179d2d7dc4cc0fa5b47dd
SSDEEP 12288:IAS+gXHVvPu/yKGSW5Q+T0J5u6Vvseilc5Wu3sCP:AlvPu9u6dse4c0mP
TLSH
T17EF45C17629902FCE0BBE17899565E06E779B80A03B19EDF03D005A72F976E49F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

512548

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdiplusShutdown GdiplusStartup GdipSaveImageToStream

mf

MFEnumDeviceSources

ole32

CoInitializeSecurity CoUninitialize CoCreateInstance CoInitializeEx CoSetProxyBlanket CreateStreamOnHGlobal CLSIDFromString CoTaskMemFree

oleaut32

VariantClear SysAllocStringLen SysAllocString SysFreeString VariantInit SysAllocStringByteLen SysStringByteLen

shell32

ShellExecuteA SHFileOperationW SHGetFolderPathW ShellExecuteW

advapi32

GetUserNameW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation RegDeleteTreeW GetSidSubAuthorityCount AllocateAndInitializeSid GetSidSubAuthority FreeSid CheckTokenMembership RegQueryValueExW RegDeleteValueW

user32

mouse_event keybd_event CallNextHookEx GetSystemMetrics VkKeyScanA DispatchMessageW PeekMessageW MapVirtualKeyA GetAsyncKeyState UnhookWindowsHookEx TranslateMessage ClipCursor SetWindowsHookExW SendMessageW OpenInputDesktop SetThreadDesktop ReleaseDC ToUnicode GetForegroundWindow GetKeyboardState GetDC MapVirtualKeyW GetWindowThreadProcessId EnumDisplayDevicesW MessageBoxA AttachThreadInput ExitWindowsEx

gdi32

DeleteObject DeleteDC CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt CreateDIBSection

shlwapi

PathRemoveFileSpecW

mfplat

MFShutdown MFCreateMediaType MFStartup MFCreateAttributes

mfreadwrite

MFCreateSourceReaderFromMediaSource

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW EnumSystemLocalesW GetFileType HeapReAlloc SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap FlushFileBuffers HeapFree HeapAlloc GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW VirtualQuery LoadLibraryExA ExpandEnvironmentStringsA InitializeSListHead CreateEventW ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GetStringTypeW GetCPInfo CompareStringEx CreateDirectoryW GetModuleFileNameW GetEnvironmentVariableW GetFileAttributesW CloseHandle CreateThread CreateProcessW GetModuleHandleW CopyFileW GetTickCount WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW Process32FirstW GetProcAddress GetCurrentProcessId ReadFile FindFirstFileW GetFileSizeEx FindNextFileW WriteFile FindClose CreateFileW DeleteFileW MoveFileExW ExitProcess SetHandleInformation ExpandEnvironmentStringsW CreatePipe SetFileAttributesW GetFileAttributesExW CreateProcessA MoveFileW GetExitCodeProcess GetCurrentProcess TerminateProcess CreateFileA LocalFree VirtualProtect VirtualAlloc CreateMutexW LoadLibraryA FlushInstructionCache IsDebuggerPresent GetTempPathW GetSystemDirectoryW MultiByteToWideChar GetComputerNameW WideCharToMultiByte GetCommandLineW GetCurrentThreadId GetTickCount64 GetSystemInfo GlobalMemoryStatusEx WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime

Name

.text

Size

703KB

Virtual Size

702KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_84918cf47f00fd398a01747933a8595d_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

gdiplus

mf

ole32

oleaut32

shell32

advapi32

user32

gdi32

shlwapi

mfplat

mfreadwrite

kernel32

generic