2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar
Size 1.8MB
Sample260723-ff3rnsgd52
SHA256 feb2e137763d42c7298c8cfb543c7d6f5c00c284fffd037f9e72d289101668ed
MD5 38aa6f8ac799c8e1abb87e723c749fe1
SHA1 b8f406b4bb5c5bde13a3b198d591dcdd88f2cf43
SHA512 f0a41a1f5a76d41137512428e60ae7f12bb7bb1cab715e96babbcdc337f2b7acaa0494498bdab71c4a2bb20f3424276fdc50a00c72a7c221ed4b960daf680f86
SSDEEP 49152:ph4RSEMBZLrpeI2pAgJKTqaB0zj0yjoB2:p9+STtB2Yyjl
TLSH
T1A995AE06626902F8D47AD07C8E42C58EE77A38A727756BCB0F9067563F23AD19E3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

.exe 1.8MB

2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 486171a6b543018116be08cadb5abf2a
SHA256 feb2e137763d42c7298c8cfb543c7d6f5c00c284fffd037f9e72d289101668ed
MD5 38aa6f8ac799c8e1abb87e723c749fe1
SHA1 b8f406b4bb5c5bde13a3b198d591dcdd88f2cf43
SHA512 f0a41a1f5a76d41137512428e60ae7f12bb7bb1cab715e96babbcdc337f2b7acaa0494498bdab71c4a2bb20f3424276fdc50a00c72a7c221ed4b960daf680f86
SSDEEP 49152:ph4RSEMBZLrpeI2pAgJKTqaB0zj0yjoB2:p9+STtB2Yyjl
TLSH
T1A995AE06626902F8D47AD07C8E42C58EE77A38A727756BCB0F9067563F23AD19E3D710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

572704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Jenkins\workspace\emist_mc-extn-browserhost_master\build\mc-extn-browserhost\x64\Release\mc-extn-browserhost.pdb

advapi32

RegQueryValueExW RegOpenKeyExW GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle TraceEvent UnregisterTraceGuids RegisterTraceGuidsW EnableTraceEx2 StartTraceW ControlTraceW OpenProcessToken GetTokenInformation OpenThreadToken RegCloseKey RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegDeleteKeyW DuplicateTokenEx SetThreadToken ConvertSidToStringSidW OpenServiceW CloseServiceHandle OpenSCManagerW

kernel32

LoadLibraryExA GetConsoleMode GetConsoleOutputCP Sleep CloseHandle GetLocaleInfoW GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetSystemInfo SetSearchPathMode OpenProcess WaitForSingleObject LoadLibraryExW FormatMessageW SetLastError RtlCaptureContext RaiseFailFastException SetUnhandledExceptionFilter IsProcessorFeaturePresent GetSystemTimeAsFileTime QueryPerformanceCounter QueryUnbiasedInterruptTime LocalFree GetCurrentProcess CreateFileW DuplicateHandle TerminateProcess CloseThreadpoolWait SetThreadpoolWait CreateEventExW CreateThreadpoolWait GetCommandLineW LCMapStringEx GetFileInformationByHandleEx GetFinalPathNameByHandleW SetFilePointerEx IsWow64Process IsWow64Process2 ReadFile SetFilePointer LocalAlloc VirtualFree VirtualAlloc VirtualQuery ReadDirectoryChangesW GetNativeSystemInfo GetLargePageMinimum GetTickCount64 LCMapStringW WideCharToMultiByte MultiByteToWideChar CompareStringW GetModuleHandleExW GetModuleFileNameW HeapReAlloc HeapFree WriteConsoleW FlushFileBuffers HeapQueryInformation HeapSize SetStdHandle HeapAlloc GetCommandLineA WriteFile ExitProcess ExitThread RtlUnwind GetFileType GetNamedPipeServerProcessId GetStdHandle IsDebuggerPresent SetDllDirectoryW GetProcessHeap SetEnvironmentVariableW FreeLibrary RtlUnwindEx LoadLibraryW GetCurrentThread FreeEnvironmentStringsW GetSystemDirectoryW SetThreadPriority GetEnvironmentStringsW GetOEMCP RtlPcToFileHeader CreateTimerQueue AddDllDirectory SetDefaultDllDirectories UnregisterWaitEx GetModuleHandleW GetCurrentProcessId DeleteCriticalSection QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList IsValidCodePage InterlockedPopEntrySList ReleaseSemaphore VirtualProtect GetVersionExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetACP TlsFree TlsSetValue QueryPerformanceFrequency FormatMessageA GetStringTypeW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW RaiseException WaitForSingleObjectEx SwitchToThread GetExitCodeThread InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetLocaleInfoEx ReleaseSRWLockShared AcquireSRWLockShared FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork FlsAlloc FlsGetValue FlsSetValue FlsFree CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer EnterCriticalSection LeaveCriticalSection EncodePointer CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW InitializeSListHead RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetStartupInfoW TlsGetValue GetProcAddress DecodePointer OutputDebugStringW GetLastError TlsAlloc ProcessIdToSessionId GetCurrentThreadId InitializeCriticalSectionEx SignalObjectAndWait CreateThread GetThreadPriority

shlwapi

PathFileExistsW PathRemoveExtensionW PathStripPathW

user32

LoadStringW

oleaut32

SysFreeString SysStringLen SysAllocStringLen VariantClear

ole32

CoUninitialize CoCreateInstance CoInitializeSecurity CoInitializeEx CoDisconnectObject CoTaskMemFree CoGetApartmentType

version

GetFileVersionInfoExW VerQueryValueW GetFileVersionInfoSizeExW

crypt32

CertGetNameStringW CertGetCertificateContextProperty CryptVerifyTimeStampSignature CryptMsgUpdate CryptMsgOpenToDecode CertGetEnhancedKeyUsage CertFindCertificateInStore CryptMemFree CryptMsgClose CertFreeCertificateChain CertFreeCertificateContext CertCloseStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertRemoveStoreFromCollection CertOpenStore CertAddStoreToCollection CryptGetMessageCertificates CryptDecodeObjectEx CryptMsgGetParam CertFindExtension

bcrypt

BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptHashData

wininet

InternetGetConnectedState

Name

.text

Size

882KB

Virtual Size

882KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

238KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_38aa6f8ac799c8e1abb87e723c749fe1_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

advapi32

kernel32

shlwapi

user32

oleaut32

ole32

version

crypt32

bcrypt

wininet

generic