2026-07-22_590b8ebb0d2f4db0775fe79c22929019_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

General

Target
2026-07-22_590b8ebb0d2f4db0775fe79c22929019_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.7MB
Sample260723-b9srcacn7y
SHA256 dd0b6b8d9c6f7500b1694614799e4d161d0adfc3ad0b2dd4a8cd36ae5c121ceb
MD5 590b8ebb0d2f4db0775fe79c22929019
SHA1 3e30b7fb30aa17047dea0f68aa5c9d5b6b2457b1
SHA512 6a3449ceb864a69af4162d67c45d008b5a77f41ef75cda23c06b3927580a765847a2b1ae8064fd9ee08aed3c73e41a6c508a5d46c676eec45384d721fbf4db69
SSDEEP 24576:NVLzmHI1mim4JsRfyzAo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DvRmAOoAoLNiXicJFFRGNzj3
TLSH
T1D285D059639C03F8F1A7A17888854506F7B1785A136196CF43F05AAB2F376B29E3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_590b8ebb0d2f4db0775fe79c22929019_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-22_590b8ebb0d2f4db0775fe79c22929019_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.7MB

2026-07-22_590b8ebb0d2f4db0775fe79c22929019_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH ce7e08ba49e8a2eb2ca63ebb8966d233
SHA256 dd0b6b8d9c6f7500b1694614799e4d161d0adfc3ad0b2dd4a8cd36ae5c121ceb
MD5 590b8ebb0d2f4db0775fe79c22929019
SHA1 3e30b7fb30aa17047dea0f68aa5c9d5b6b2457b1
SHA512 6a3449ceb864a69af4162d67c45d008b5a77f41ef75cda23c06b3927580a765847a2b1ae8064fd9ee08aed3c73e41a6c508a5d46c676eec45384d721fbf4db69
SSDEEP 24576:NVLzmHI1mim4JsRfyzAo/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:DvRmAOoAoLNiXicJFFRGNzj3
TLSH
T1D285D059639C03F8F1A7A17888854506F7B1785A136196CF43F05AAB2F376B29E3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

224352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

G:\devops_yanfa\workspace\p-33dea31079204598ae81e140b4e0cf7e\src\Bin\x64\Release\WsNativePushService.pdb

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

kernel32

FindFirstFileW GetTempPathW FindClose GetFileAttributesW GetTimeZoneInformation CreateDirectoryW GetProcAddress FreeLibrary LoadLibraryExW InitializeCriticalSection CreateMutexW WaitForSingleObject ReleaseMutex DeleteCriticalSection HeapSize LocalFree FormatMessageW LocalAlloc ConnectNamedPipe lstrcmpiW GetCurrentProcessId GetOverlappedResult CloseHandle Process32FirstW SetEvent Process32NextW GetLastError Sleep CreateEventW CreateToolhelp32Snapshot OpenProcess DisconnectNamedPipe GetCurrentThreadId WaitForMultipleObjects CreateNamedPipeW GetModuleFileNameW ReadFile WriteConsoleW SetEndOfFile GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx EncodePointer DecodePointer GetLocaleInfoEx LCMapStringEx RtlUnwind GetSystemTimeAsFileTime GetModuleHandleW GetStringTypeW CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW FindFirstFileExW FindNextFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe DeleteFileW MoveFileExW GetStdHandle WriteFile ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx GetCurrentDirectoryW GetFullPathNameW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadConsoleW HeapReAlloc

advapi32

RegisterServiceCtrlHandlerExW SetSecurityDescriptorDacl CreateServiceW CloseServiceHandle OpenSCManagerW SetServiceStatus ChangeServiceConfig2W DeleteService ControlService OpenProcessToken StartServiceW InitializeSecurityDescriptor CreateProcessAsUserW StartServiceCtrlDispatcherW OpenServiceW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

402KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_590b8ebb0d2f4db0775fe79c22929019_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

userenv

kernel32

advapi32

version

generic