2026-07-22_254cb2d4b30454460275810f53e36a28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_254cb2d4b30454460275810f53e36a28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 2.0MB
Sample260722-wpzpda1dph
SHA256 eab5b3e0c0aba3356fa8f196f529e96328edefe12f10c3cf3c2a5a5649494087
MD5 254cb2d4b30454460275810f53e36a28
SHA1 358361d7baebeb6a9b8f9aa0031f331bfc64409a
SHA512 3d1c3978642023f941f068cb6c12b74b36428f25d9d87fa6380573dd0ff7ff2a0c2d16233e3c9fbfd4bfa866b2faf15917adbeb8c0c3b25122ffd6e60d7db06d
SSDEEP 49152:J1jqltr6/x9RgX9JEMKHVmG+Xku0pB+hoFhA:vopzXkfM
TLSH
T189A58D1A62A800ECD1BBD2BC9947AA07EBB1780107619BDF42A1176B1F777F05E7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-22_254cb2d4b30454460275810f53e36a28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 2.0MB

2026-07-22_254cb2d4b30454460275810f53e36a28_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH b97636a015da3b7473c6d17f32a6527e
SHA256 eab5b3e0c0aba3356fa8f196f529e96328edefe12f10c3cf3c2a5a5649494087
MD5 254cb2d4b30454460275810f53e36a28
SHA1 358361d7baebeb6a9b8f9aa0031f331bfc64409a
SHA512 3d1c3978642023f941f068cb6c12b74b36428f25d9d87fa6380573dd0ff7ff2a0c2d16233e3c9fbfd4bfa866b2faf15917adbeb8c0c3b25122ffd6e60d7db06d
SSDEEP 49152:J1jqltr6/x9RgX9JEMKHVmG+Xku0pB+hoFhA:vopzXkfM
TLSH
T189A58D1A62A800ECD1BBD2BC9947AA07EBB1780107619BDF42A1176B1F777F05E7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

20:9b:13:29:65:f7:46:35:9c:96:8e:1f:aa:03:ae:ff:c5:9e:3a:e2:82:6f:04:59:fd:eb:75:bb:7d:4c:c2:3e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=9144030071526726XG,CN=Tencent Technology (Shenzhen) Company Limited,O=Tencent Technology (Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong Province,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13085368656e7a68656e,1.3.6.1.4.1.311.60.2.1.2=#13124775616e67646f6e672050726f76696e6365,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 10, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

0e:c3:88:08:64:ad:eb:96:ca:fc:6a:ab:af:da:1f:94

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 14, 2025 - Oct 19, 2028

Minor OS version

Major OS version

Entry point

1364780

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\agent\workspace\BuildDLL\setup\bin\assist.pdb

gcloudcore

?XLog@ABase@@YAXW4ALogPriority@GCloud@@PEBDI11ZZ ?GetInstance@IGCloudCore@ABase@@SAAEAV12@XZ ?SetABaseLogMode@ABase@@YAXW4TLogMode@GCloud@@@Z

tdatamaster

?GetInstance@ITDataMaster@TDM@@SAPEAV12@XZ

sqlcipher

sqlite3_key sqlite3_close sqlite3_prepare_v2 sqlite3_open_v2 sqlite3_busy_timeout sqlite3_column_count sqlite3_finalize sqlite3_column_text sqlite3_exec sqlite3_step

libcurl-x64

curl_slist_free_all curl_easy_setopt curl_easy_cleanup curl_slist_append curl_easy_init curl_easy_getinfo curl_easy_perform

dxgi

CreateDXGIFactory

kernel32

SetStdHandle GetFullPathNameW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetTimeZoneInformation GetTimeFormatW GetDateFormatW FlushFileBuffers SetFilePointerEx GetFileSizeEx CompareStringW GetStdHandle ExitProcess WaitForSingleObject MultiByteToWideChar WideCharToMultiByte FindNextFileW InitializeCriticalSectionEx FindClose GetLastError RaiseException DecodePointer DeleteCriticalSection Sleep CreateMutexW GetOEMCP CloseHandle SetEndOfFile HeapFree EnterCriticalSection GetCommandLineW GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection HeapSize DeleteFileW HeapReAlloc LoadLibraryW HeapAlloc SetCurrentDirectoryW GetProcAddress LocalFree GetProcessHeap GetModuleHandleW FreeLibrary SetDllDirectoryW GetDriveTypeW GetSystemInfo GlobalMemoryStatusEx GetCurrentProcessId GetCurrentDirectoryW SetLastError RtlVirtualUnwind GetEnvironmentVariableW GetConsoleOutputCP WriteFile ReadConsoleW GetConsoleMode ReadFile SetEnvironmentVariableW FindFirstFileExW IsValidCodePage GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleW GetACP ReleaseMutex MoveFileExW CreateDirectoryW GetFileAttributesExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetFileInformationByHandle CreateFileW LoadLibraryExW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryEnterCriticalSection GetCurrentThreadId QueryPerformanceCounter WaitForSingleObjectEx InitOnceComplete InitOnceBeginInitialize GetStringTypeW EncodePointer FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime LCMapStringEx GetLocaleInfoEx CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW RtlUnwindEx RtlPcToFileHeader TlsAlloc TlsGetValue TlsSetValue TlsFree RtlUnwind

user32

MonitorFromPoint GetDC GetMonitorInfoW EnumDisplaySettingsW ReleaseDC MessageBoxW

gdi32

GetDeviceCaps

shell32

SHGetSpecialFolderPathW CommandLineToArgvW

ole32

CoCreateInstance CoCreateGuid CoUninitialize CoInitialize

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

357KB

Virtual Size

356KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

42KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=11, id=259, version=30795,

count=199, id=261, version=30795,

count=2, id=225, version=20806,

count=18, id=260, version=30034,

count=10, id=259, version=30034,

count=96, id=261, version=30034,

count=2, id=253, version=28518,

count=22, id=260, version=30795,

count=1, id=262, version=30795,

count=20, id=257, version=30795,

count=2, id=257, version=30148,

count=5, id=260, productName=VS2019 v16.10.4 build 30040, version=30040,

count=5, productName=Unmarked objects (old),

count=2, id=257, productName=VS2017 v15.8.5 build 26732, version=26732,

count=41, id=261, version=30147,

count=3, id=257, productName=VS2015 UPD3.1 build 24215, version=24215,

count=219, id=1, productName=Unmarked objects,

count=22, id=265, version=30159,

count=1, id=256, version=30159,

count=1, id=255, version=30159,

count=1, id=258, version=30159,