2026-07-20_a26e7f4c93ce6f448e7c24cf34bfb07f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

General

Target
2026-07-20_a26e7f4c93ce6f448e7c24cf34bfb07f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 622KB
Sample260720-jgr84sat2r
SHA256 d8d16c4eec2f4a7a61a86f8c3c6cde476e18af960689f9cc9d5f231ce8b4012d
MD5 a26e7f4c93ce6f448e7c24cf34bfb07f
SHA1 c54ebe895157735179db7cb86d5be65e2522c4d0
SHA512 a27a563b7e2d0cc773d7475d3a258fd2c850736e5551d79ee0af748d8922a887e0ab66fe1e26365ce9ec9006a1a8333e96e18cf660a0f60ea2fe62704adefa00
SSDEEP 12288:0kIFuus9klvkRSPKEr9ukC8a1U9fV0GOyUjtGQFITZjWrfNjMlytCKL8se:NmuusClvkRIVr9v9V0GY4YrVQQtCo8se
TLSH
T111D4F121B7950CF9ED6BC23D89925646E9F27C060720DADF07E056AB1F237A09D3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-20_a26e7f4c93ce6f448e7c24cf34bfb07f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 622KB

2026-07-20_a26e7f4c93ce6f448e7c24cf34bfb07f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 52cee9c1bc4bda1f4f98a36e5ef61615
SHA256 d8d16c4eec2f4a7a61a86f8c3c6cde476e18af960689f9cc9d5f231ce8b4012d
MD5 a26e7f4c93ce6f448e7c24cf34bfb07f
SHA1 c54ebe895157735179db7cb86d5be65e2522c4d0
SHA512 a27a563b7e2d0cc773d7475d3a258fd2c850736e5551d79ee0af748d8922a887e0ab66fe1e26365ce9ec9006a1a8333e96e18cf660a0f60ea2fe62704adefa00
SSDEEP 12288:0kIFuus9klvkRSPKEr9ukC8a1U9fV0GOyUjtGQFITZjWrfNjMlytCKL8se:NmuusClvkRIVr9v9V0GY4YrVQQtCo8se
TLSH
T111D4F121B7950CF9ED6BC23D89925646E9F27C060720DADF07E056AB1F237A09D3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

80:6e:25:7e:4b:59:82:b3:d3:e1:a1:b6:9b:19:bd:ce:fb:9d:23:95:f5:ee:36:bc:36:35:0a:61:0c:c0:d3:76

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 17, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:1d:67:d6:e7:7f:e2:d2:68:d3:00:00:00:00:01:1d

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 5, 2026 - Mar 3, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:29:0e:d5:64:2a:b4:97:f2:1a:00:01:00:00:02:29

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

30576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MpWUStub.pdb

advapi32

UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle TraceMessage EventWriteTransfer RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey EventUnregister EventRegister OpenThreadToken OpenProcessToken GetLengthSid CheckTokenMembership FreeSid CopySid AllocateAndInitializeSid

kernel32

CloseHandle IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError SetLastError GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentThread GetCurrentThreadId HeapAlloc HeapFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime FreeLibrary GetProcAddress LoadLibraryExW CompareStringW LCMapStringW IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW MultiByteToWideChar ExitProcess GetModuleHandleW GetModuleHandleExW GetProcessHeap WideCharToMultiByte HeapSize HeapReAlloc GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead EncodePointer RaiseException InitializeCriticalSectionEx CallNamedPipeW InitializeProcThreadAttributeList CreateToolhelp32Snapshot UpdateProcThreadAttribute Process32NextW Process32FirstW DeleteProcThreadAttributeList WaitNamedPipeW VirtualQuery FlushFileBuffers GetProcessId GetProcessTimes GetCommandLineW GetThreadTimes GetModuleFileNameW GetEnvironmentVariableW GetSystemDirectoryW HeapSetInformation CreateProcessW GetExitCodeProcess FindNextFileW WriteFile SetEnvironmentVariableW FindClose WaitForSingleObject CreateFileW GetFileAttributesW OpenProcess CreateEventW SetEvent WaitForSingleObjectEx ResetEvent SetFilePointerEx QueryFullProcessImageNameW VirtualLock GetStdHandle GetCommandLineA FindFirstFileExW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetConsoleOutputCP GetConsoleMode WriteConsoleW DecodePointer

rpcrt4

UuidCreate

ntdll

RtlNtStatusToDosError RtlGetVersion RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_a26e7f4c93ce6f448e7c24cf34bfb07f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

advapi32

kernel32

rpcrt4

ntdll

generic