2026-07-30_0d792b497c6a0292b235c9661ee8a167_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_0d792b497c6a0292b235c9661ee8a167_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.4MB
Sample260730-l7kytswald
SHA256 d54bc13a82c059dfa0e14fbbc667e0f3be87328fdd626987fc250d264693d644
MD5 0d792b497c6a0292b235c9661ee8a167
SHA1 d46005caf73d63ef20d49c883870825d671ee37f
SHA512 4d9d5ad15af628f6c998369f9ef6a46ce857a8f272080f4567e2ff895b4b716bf95941dba2b1da8435078c1249b9b2803c2c195c0db6d0a934d44d2ed621bfa1
SSDEEP 24576:skezBagnFkYIS+gzx/T0BkignSRMKkCHc65wvGNQ7gw6b4NEpEMgPQ:sh0/S+IxQRgnSRMAGgh/EM0
TLSH
T17265D04AF3E942ECD1775535C6A1621BEB71B8250B3087CF63A40668AF736E08EB7711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_0d792b497c6a0292b235c9661ee8a167_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-07-30_0d792b497c6a0292b235c9661ee8a167_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.4MB

2026-07-30_0d792b497c6a0292b235c9661ee8a167_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH f8f6655d8929c68c4200575c4350df40
SHA256 d54bc13a82c059dfa0e14fbbc667e0f3be87328fdd626987fc250d264693d644
MD5 0d792b497c6a0292b235c9661ee8a167
SHA1 d46005caf73d63ef20d49c883870825d671ee37f
SHA512 4d9d5ad15af628f6c998369f9ef6a46ce857a8f272080f4567e2ff895b4b716bf95941dba2b1da8435078c1249b9b2803c2c195c0db6d0a934d44d2ed621bfa1
SSDEEP 24576:skezBagnFkYIS+gzx/T0BkignSRMKkCHc65wvGNQ7gw6b4NEpEMgPQ:sh0/S+IxQRgnSRMAGgh/EM0
TLSH
T17265D04AF3E942ECD1775535C6A1621BEB71B8250B3087CF63A40668AF736E08EB7711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

407384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

ole32

CoUninitialize CoCreateInstance CoInitializeEx

kernel32

WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter Sleep WriteProcessMemory GetProcessId OpenProcess CreateToolhelp32Snapshot Process32NextW K32GetModuleBaseNameW Process32FirstW CloseHandle GetSystemInfo K32GetModuleInformation VirtualProtectEx ReadProcessMemory K32EnumProcessModules VirtualQueryEx GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW GlobalLock FindClose OutputDebugStringW GetFileSizeEx GetConsoleOutputCP FlushFileBuffers LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc ReadConsoleW GetConsoleMode SetFilePointerEx GetCommandLineW GetCommandLineA ExitProcess WriteFile FreeLibraryAndExitThread ExitThread CreateThread WriteConsoleW GlobalFree GlobalAlloc MultiByteToWideChar GetProcessHeap CreateFileW GetModuleHandleExW GetModuleFileNameW HeapSize HeapReAlloc SetEndOfFile FindFirstFileExW WakeAllConditionVariable GetFileType GetStdHandle ReadFile LoadLibraryExW TlsFree GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime GetModuleHandleW GetCurrentProcessId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue

user32

EmptyClipboard GetClipboardData SetClipboardData OpenClipboard GetWindowLongW DefWindowProcW GetWindowRect DestroyWindow SetWindowRgn CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW SetWindowLongA PeekMessageW MoveWindow SetLayeredWindowAttributes TranslateMessage LoadIconW PostQuitMessage UpdateWindow GetKeyState GetMessageExtraInfo GetCursorPos ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos CloseClipboard

gdi32

CreateRoundRectRgn

shell32

ShellExecuteW

imm32

ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext

dwmapi

DwmExtendFrameIntoClientArea

Name

.text

Size

565KB

Virtual Size

565KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

151KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

651KB

Virtual Size

657KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_0d792b497c6a0292b235c9661ee8a167_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

d3d11

d3dcompiler_47

ole32

kernel32

user32

gdi32

shell32

imm32

dwmapi

generic