2026-07-29_df0125ac5cac657297f18e8f2f0cb7a5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

General

Target
2026-07-29_df0125ac5cac657297f18e8f2f0cb7a5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 3.3MB
Sample260729-mhtecaff95
SHA256 7fb02747d1e7571051b7e4a71144505e41a2820ed2b5d0ea329da1723d73ce01
MD5 df0125ac5cac657297f18e8f2f0cb7a5
SHA1 70fe2c5a9b0db8a5adfef2d3450d02be9760d359
SHA512 6b3172c627f4f402fa9d9ba67b0952c54b0290e718d92220c63e70279761475ed88614c7676aefcdab611fdb08970518c516959b3bc29233b8e574d030e84bd6
SSDEEP 49152:UXiKJEvfDhmWbSRMZubskbNTAbnBispVW5x0rI2YB/y8hA/WJEB:lmSNmWmRMZubskbfJ/a5ea8XEB
TLSH
T15BF50213F3A642ECD56BA5389566674BF73978150720C6CF03E44AAD3FA32E00E7A791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_df0125ac5cac657297f18e8f2f0cb7a5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-29_df0125ac5cac657297f18e8f2f0cb7a5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 3.3MB

2026-07-29_df0125ac5cac657297f18e8f2f0cb7a5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH ecdedb1de567f5b63c4e9417ec46ef76
SHA256 7fb02747d1e7571051b7e4a71144505e41a2820ed2b5d0ea329da1723d73ce01
MD5 df0125ac5cac657297f18e8f2f0cb7a5
SHA1 70fe2c5a9b0db8a5adfef2d3450d02be9760d359
SHA512 6b3172c627f4f402fa9d9ba67b0952c54b0290e718d92220c63e70279761475ed88614c7676aefcdab611fdb08970518c516959b3bc29233b8e574d030e84bd6
SSDEEP 49152:UXiKJEvfDhmWbSRMZubskbNTAbnBispVW5x0rI2YB/y8hA/WJEB:lmSNmWmRMZubskbfJ/a5ea8XEB
TLSH
T15BF50213F3A642ECD56BA5389566674BF73978150720C6CF03E44AAD3FA32E00E7A791
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

57788

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptGenRandom

kernel32

RtlVirtualUnwind WriteConsoleW GetStdHandle CreateFileW DeleteFileW WriteFile GetTempPathW CloseHandle WaitForSingleObject CreateRemoteThread OpenProcess VirtualAllocEx ReadProcessMemory WriteProcessMemory VirtualFreeEx GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW GetConsoleMode SetConsoleMode SetConsoleOutputCP SetConsoleTitleA CreateToolhelp32Snapshot Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive Sleep WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess GetCurrentProcessId GetCurrentThreadId InitializeSListHead HeapSize RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetExitCodeProcess CreateProcessW GetFileAttributesExW GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_df0125ac5cac657297f18e8f2f0cb7a5_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

bcrypt

kernel32

generic