2026-07-20_4d2b6688a36f96b35430d326f974b580_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_4d2b6688a36f96b35430d326f974b580_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar
Size 1.5MB
Sample260720-rysvzaft6t
SHA256 5b094e15f2b3495fbe74acd6fccc3c3e734bbe3ffcca813359e84ed635c17880
MD5 4d2b6688a36f96b35430d326f974b580
SHA1 03f93960877c50d2d4eddf6b48f2e81f665960cb
SHA512 257f0186aca0b68998fbc86107402160a5bee4402e107c2459875b4660d65635f2756bea10f630de3fb754f60e20f6fd8c0b6ebf0c1f91ff16f6990c7b4b807b
SSDEEP 24576:pwGBSAws1CFO6719ua4TtCXrvmXUv4kFgXe4i7ojhsP5Lgrk1TWb4AN5:pwGsNWr6vuZTYrmkv4kQe30jaNf1TWbp
TLSH
T10A658B26F7DC20FBE46693B742554582F6B07809132477CB0A9CC3E96F7A6F19E3A214
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_4d2b6688a36f96b35430d326f974b580_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-07-20_4d2b6688a36f96b35430d326f974b580_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

.exe 1.5MB

2026-07-20_4d2b6688a36f96b35430d326f974b580_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 46c91e2b124a4d760bffd434bc2f2765
SHA256 5b094e15f2b3495fbe74acd6fccc3c3e734bbe3ffcca813359e84ed635c17880
MD5 4d2b6688a36f96b35430d326f974b580
SHA1 03f93960877c50d2d4eddf6b48f2e81f665960cb
SHA512 257f0186aca0b68998fbc86107402160a5bee4402e107c2459875b4660d65635f2756bea10f630de3fb754f60e20f6fd8c0b6ebf0c1f91ff16f6990c7b4b807b
SSDEEP 24576:pwGBSAws1CFO6719ua4TtCXrvmXUv4kFgXe4i7ojhsP5Lgrk1TWb4AN5:pwGsNWr6vuZTYrmkv4kQe30jaNf1TWbp
TLSH
T10A658B26F7DC20FBE46693B742554582F6B07809132477CB0A9CC3E96F7A6F19E3A214
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

181476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Projects\SoundEdge\APO\x64\Release\SECOMN64.exe.pdb

oleaut32

VariantClear VariantInit VARIANT_UserUnmarshal64 VARIANT_UserFree64 VARIANT_UserMarshal VARIANT_UserSize VARIANT_UserUnmarshal VARIANT_UserFree VARIANT_UserMarshal64 VARIANT_UserSize64

rpcrt4

RpcBindingVectorFree RpcEpUnregister RpcServerUnregisterIf RpcServerListen RpcEpRegisterW NdrServerCall2 RpcServerInqBindings NdrServerCallAll RpcServerRegisterIf3 RpcServerUseProtseqEpW I_RpcBindingInqLocalClientPID

kernel32

WaitForSingleObject SetEvent CreateThread HeapReAlloc GetFileSizeEx GetModuleFileNameW FreeLibrary ReadFile SetStdHandle GetProcessHeap GetCurrentThreadId GetCurrentProcess FindFirstFileW CloseHandle HeapSize IsDebuggerPresent IsProcessorFeaturePresent LoadLibraryW CreateEventW FreeResource SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP WaitForMultipleObjects FindClose DecodePointer ResumeThread CreateMutexExW Sleep GetACP IsValidCodePage GetProcAddress GetModuleHandleW GetTimeZoneInformation QueryPerformanceCounter FindNextFileW FindResourceW SizeofResource WTSGetActiveConsoleSessionId GetConsoleMode LockResource GetFileType CreateProcessW ConnectNamedPipe WriteFile DisconnectNamedPipe DuplicateHandle LoadResource CreateNamedPipeW EnumSystemLocalesW OpenProcess GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapFree HeapAlloc OutputDebugStringW FormatMessageW DeleteCriticalSection InitializeCriticalSectionEx CreateThreadpoolWork SubmitThreadpoolWork RaiseException GetCommandLineW GetCommandLineA GetStdHandle FreeLibraryAndExitThread ExitThread GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount TerminateProcess MultiByteToWideChar LocalFree LocalAlloc GetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter GetConsoleOutputCP SetThreadPriority ReleaseMutex LeaveCriticalSection EnterCriticalSection GetProductInfo WriteConsoleW CreateFileW RtlPcToFileHeader GetModuleHandleA TryEnterCriticalSection WideCharToMultiByte FlushFileBuffers RtlUnwindEx GetStartupInfoW GetCPInfo SetLastError CompareStringEx GetLocaleInfoEx FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx EncodePointer GetExitCodeThread WaitForSingleObjectEx GetCurrentProcessId QueryPerformanceFrequency AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable GetStringTypeW SetFilePointerEx FindFirstFileExW InitializeSListHead GetSystemTimeAsFileTime InitializeCriticalSection

ole32

StringFromCLSID CoTaskMemFree CoCreateInstance CoInitializeEx CoCreateGuid

advapi32

RevertToSelf RegOpenKeyExW DeleteService QueryServiceStatus ControlService OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW EventWriteString SetServiceStatus EventUnregister EventRegister RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW ImpersonateLoggedOnUser DuplicateTokenEx SetEntriesInAclW CreateProcessAsUserW FreeSid AllocateAndInitializeSid RegDeleteValueW EqualSid GetTokenInformation OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor RegDeleteKeyW RegQueryValueExW RegCloseKey

user32

RegisterClassW PostQuitMessage MessageBoxW DefWindowProcW GetWindowLongPtrW SetWindowLongPtrW DispatchMessageW TranslateMessage GetMessageW CreateWindowExW GetClassInfoW PostMessageW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

wtsapi32

WTSRegisterSessionNotification WTSQueryUserToken WTSUnRegisterSessionNotification

secomn64

SEAPOCOMAPI_StartReceiveConfigChange SEAPOCOMAPI_ReceiveConfigChange SEAPOCOMAPI_CancelReceiveParamChange SEAPOCOMAPI_ReceiveParamChange SEAPOCOMAPI_ReceiveParamChangeEx SEAPOCOMAPI_StartReceiveParamChange SEAPOCOMAPI_CancelReceiveConfigChange SEAPOCOMAPI_StartReceiveStateChange SEAPOCOMAPI_ReceiveStateChange SEAPOCOMAPI_CancelReceiveStateChange SEAPOCOMAPI_DeactivateEndpoint SEAPOCOMAPI_ActivateEndpoint SEAPOCOMAPI_ResetUserParameter SEAPOCOMAPI_ResetUserParametersEx SEAPOCOMAPI_GetUserParameterI32 SEAPOCOMAPI_GetUserParameter SEAPOCOMAPI_SetUserParameterEx SEAPOCOMAPI_SetUserParameterI32 SEAPOCOMAPI_SetUserParameter SEAPOCOMAPI_GetDetectedContentType SEAPOCOMAPI_RegGetContentTypeAlias SEAPOCOMAPI_RegFreeContentTypes SEAPOCOMAPI_RegGetContentTypes SEAPOCOMAPI_DeleteUserProfile SEAPOCOMAPI_CopyUserProfile SEAPOCOMAPI_GetUserProfileAlias SEAPOCOMAPI_SetUserProfileAlias SEAPOCOMAPI_GetUserProfileW SEAPOCOMAPI_GetUserProfile SEAPOCOMAPI_SetUserProfileW SEMISCAPI_GetDefaultBrowser SEAPOCOMAPI_FreeProfileNames SEAPOCOMAPI_GetUserProfiles SEAPOCOMAPI_GetEngine SEAPOCOMAPI_GetEngineDefaultConfig SEAPOCOMAPI_SetEngine SEAPOCOMAPI_SetEndpointFxPropertyValueEx2 SEAPOCOMAPI_SetEndpointFxPropertyValueEx SEAPOCOMAPI_SetEndpointFxPropertyValue SEAPOCOMAPI_GetEndpointFxPropertyValueEx2 SEAPOCOMAPI_GetEndpointFxPropertyValueEx SEAPOCOMAPI_GetEndpointFxPropertyValue SEAPOCOMAPI_GetEndpointEx SEAPOCOMAPI_GetEndpoint SEAPOCOMAPI_GetEndpointPropertyValue SEAPOCOMAPI_SetEndpointVolume SEAPOCOMAPI_GetUserParameterEx SEAPOCOMAPI_GetEndpointVolume SEAPOCOMAPI_FreeIOConfigs SEAPOCOMAPI_FreeContentTypes SEAPOCOMAPI_GetContentType SEAPOCOMAPI_SetIOConfig SEAPOCOMAPI_GetIOConfigs SEAPOCOMAPI_GetIOConfig SEAPOCOMAPI_GetLastError SEAPOCOMAPI_InitializeAPI SEAPOCOMAPI_FreeAPI SEAPOCOMAPI_FreeEndpointIDs SEAPOCOMAPI_FreeEndpoint SEAPOCOMAPI_SetDetectedContentType SEAPOCOMAPI_SetContentType SEAPOCOMAPI_SetAPOType SEAPOCOMAPI_GetEndpoint2 SEAPOCOMAPI_GetEndpointIDsEx SEAPOCOMAPI_InitializeAPIEx SEMISCAPI_OpenBrowser SEMISCAPI_IsBrowserExtensionInstalled SEAPOCOMAPI_GetWindowsLastError SEAPOCOMAPI_StartReceiveDataChange SEAPOCOMAPI_CancelReceiveDataChange SEAPOCOMAPI_SetUserProfile SEAPOCOMAPI_ReceiveDataChange SEAPOCOMAPI_GetContentTypes

ntdll

RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry

Name

.text

Size

524KB

Virtual Size

524KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

186KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_4d2b6688a36f96b35430d326f974b580_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

oleaut32

rpcrt4

kernel32

ole32

advapi32

user32

version

userenv

api-ms-win-security-base-l1-2-2

wtsapi32

secomn64

ntdll

generic