2026-07-22_069c4674a89ae0cc5a7d9a81eee10dc0_cobalt-strike_icedid_luca-stealer_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_069c4674a89ae0cc5a7d9a81eee10dc0_cobalt-strike_icedid_luca-stealer_njrat_vidar
Size 2.5MB
Sample260722-ww2gjsxtdw
SHA256 113257d059b5571edeb998ddea4d12b17d84ee3fc34981092fc202e1aadacf5c
MD5 069c4674a89ae0cc5a7d9a81eee10dc0
SHA1 62541f2525f583f1d4046d3ab6156b31a83273ad
SHA512 cff78106a662d44ea24c48f1d83ac5e36671e0c58a253d276763b9fa38c1a10b6e7a328fec2bdc67db053ef733ca4b45e2f84c582a56d593d56ec222f8b489bb
SSDEEP 49152:BYfSio6s+xFu4t8UXKog4VLozob7f6eFCtbJQrOxecRB+kn3Hnx:Wu4t87VoH8RuJ4+k
TLSH
T155C59E1BA2AD02F9D0B6D17CC947590BDBB2380A43715BEF02D146671F6BAE18E7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_069c4674a89ae0cc5a7d9a81eee10dc0_cobalt-strike_icedid_luca-stealer_njrat_vidar

File Explorer

2026-07-22_069c4674a89ae0cc5a7d9a81eee10dc0_cobalt-strike_icedid_luca-stealer_njrat_vidar

.exe 2.5MB

2026-07-22_069c4674a89ae0cc5a7d9a81eee10dc0_cobalt-strike_icedid_luca-stealer_njrat_vidar

IMPHASH 3be0334c859a25685da37a000d13f606
SHA256 113257d059b5571edeb998ddea4d12b17d84ee3fc34981092fc202e1aadacf5c
MD5 069c4674a89ae0cc5a7d9a81eee10dc0
SHA1 62541f2525f583f1d4046d3ab6156b31a83273ad
SHA512 cff78106a662d44ea24c48f1d83ac5e36671e0c58a253d276763b9fa38c1a10b6e7a328fec2bdc67db053ef733ca4b45e2f84c582a56d593d56ec222f8b489bb
SSDEEP 49152:BYfSio6s+xFu4t8UXKog4VLozob7f6eFCtbJQrOxecRB+kn3Hnx:Wu4t87VoH8RuJ4+k
TLSH
T155C59E1BA2AD02F9D0B6D17CC947590BDBB2380A43715BEF02D146671F6BAE18E7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1337520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qba2\workspace\6834\SSE_Storage_Middleware\RstMwService\output\Release\x64\RstMwService.pdb

kernel32

DeleteCriticalSection CreateFileA DecodePointer InitializeCriticalSectionEx InitializeCriticalSection FormatMessageW CreateMutexA EnterCriticalSection LeaveCriticalSection ResetEvent CreateEventA GetSystemTimeAsFileTime LocalAlloc DeleteFileA ReadFile Sleep lstrlenA GetCommandLineA VerSetConditionMask VerifyVersionInfoA GetCommandLineW FindClose LocalFree FindFirstFileExW FindNextFileW GetTickCount GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetDiskFreeSpaceExA CompareStringEx CreateFileW SetLastError DeviceIoControl LCMapStringEx InitOnceExecuteOnce FormatMessageA SleepConditionVariableCS WakeConditionVariable ReleaseMutex GetModuleHandleA GetVersion OpenProcess FreeLibrary LoadLibraryExA SetDefaultDllDirectories GetPackageId GetPackagePath InitializeConditionVariable K32GetModuleBaseNameW K32GetModuleFileNameExW TryEnterCriticalSection TryAcquireSRWLockExclusive InitializeSRWLock GetExitCodeThread WaitForSingleObjectEx GetSystemTimePreciseAsFileTime SetWaitableTimer CreateWaitableTimerA QueryPerformanceFrequency GetCurrentProcessId QueryPerformanceCounter CreateMutexW WaitForMultipleObjects GetFirmwareEnvironmentVariableW SetFirmwareEnvironmentVariableW OpenEventA OpenMutexA GetCurrentProcess GetProcAddress WaitForSingleObject CloseHandle GetLastError CreateEventW InitializeSListHead SleepConditionVariableSRW HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount SetEvent WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive EncodePointer InterlockedPushEntrySList RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCurrentThreadId ExitProcess GetModuleHandleW FlsAlloc FlsGetValue FlsSetValue FlsFree LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW RaiseException GetStdHandle GetFileType GetStartupInfoW WideCharToMultiByte MultiByteToWideChar GetCPInfo GetStringTypeW IsValidCodePage GetACP GetOEMCP GetFileSizeEx SetFilePointerEx SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode GetModuleFileNameW WriteConsoleW RtlUnwindEx

advapi32

RevertToSelf InitiateSystemShutdownA RegSetKeyValueW RegCreateKeyExW StartServiceCtrlDispatcherW UnregisterTraceGuids RegisterTraceGuidsW LookupPrivilegeValueA GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle RegisterServiceCtrlHandlerW TraceMessage SetServiceStatus AdjustTokenPrivileges OpenProcessToken RegQueryValueExW RegOpenKeyExW RegSetValueExA RegQueryValueExA RegOpenKeyExA AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl RegDeleteValueA RegCreateKeyExA RegCloseKey ImpersonateLoggedOnUser ReportEventW RegDeleteTreeA QueryServiceStatusEx OpenServiceA OpenSCManagerA SetEntriesInAclW CheckTokenMembership EnumDependentServicesA DeleteService ControlService RegisterEventSourceW DeregisterEventSource CloseServiceHandle ChangeServiceConfigA

ntdll

RtlFreeUnicodeString RtlAnsiStringToUnicodeString RtlInitAnsiString

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

rpcrt4

UuidToStringA NdrServerCallAll RpcBindingVectorFree RpcServerInqBindings RpcServerListen RpcServerRegisterIf3 I_RpcBindingInqLocalClientPID I_RpcGetCurrentCallHandle RpcServerUnregisterIf RpcServerUseProtseqEpW RpcMgmtStopServerListening NdrServerCall2 RpcStringFreeA RpcRevertToSelfEx RpcEpRegisterW RpcEpUnregister RpcRevertToSelf RpcImpersonateClient

setupapi

CM_Get_Device_Interface_List_SizeW CM_Get_Device_ID_ListW CM_Get_Device_ID_List_SizeW CM_Get_Device_Interface_ListW CM_Locate_DevNodeW

api-ms-win-devices-swdevice-l1-1-0

SwDeviceClose SwDeviceCreate

api-ms-win-devices-swdevice-l1-1-1

SwDeviceSetLifetime

ole32

CoMarshalInterThreadInterfaceInStream CoTaskMemFree CoReleaseMarshalData CoCreateGuid StringFromGUID2 CoInitializeEx CoSetProxyBlanket CoGetInterfaceAndReleaseStream CoCreateInstance CoUninitialize

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_PropertyW CM_Get_Device_Interface_PropertyW

user32

GetSystemMetrics

api-ms-win-core-path-l1-1-0

PathCchAppend

oleaut32

SafeArrayLock SafeArrayCreate VariantClear VariantInit SysFreeString SysAllocString SafeArrayUnlock

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

427KB

Virtual Size

426KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

50KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_069c4674a89ae0cc5a7d9a81eee10dc0_cobalt-strike_icedid_luca-stealer_njrat_vidar

kernel32

advapi32

ntdll

api-ms-win-security-base-l1-2-2

rpcrt4

setupapi

api-ms-win-devices-swdevice-l1-1-0

api-ms-win-devices-swdevice-l1-1-1

ole32

api-ms-win-devices-config-l1-1-1

user32

api-ms-win-core-path-l1-1-0

oleaut32

generic