2026-08-01_ee1b8e9afbe684d9dcf05512c96dfe6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_ee1b8e9afbe684d9dcf05512c96dfe6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 772KB
Sample260801-fb2ntadg87
SHA256 5064ecd08dd3990aa41e171676187a5cff04b22a981df34ed77323609464c27e
MD5 ee1b8e9afbe684d9dcf05512c96dfe6d
SHA1 a6e9a34cf7328c4b0d624de6c1ab8b4fd59bf701
SHA512 883232ecc0834c60a2e7a96f0be3514f5a01d23123367c04f23a916b54761ac2c62c684d76e40370aceea4e6bc4ae94fd9a0bc17082fadba75defc89ff69c10c
SSDEEP 12288:Y34iccTLfVbYisdDDCnGKcSRpGCwFy0WlIOcgZFbHMy7mvnO3leMpIs7UpHP8Rco:Yoi/HVB/sNIoHkRcwfYLwqNEotje
TLSH
T1B1F47C3E669901E8E5B7E175C9AA5A06F7F1740A1235960F73F80B6A1F37B305F2A310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICOUS_EXE_References_VEEAM

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_ee1b8e9afbe684d9dcf05512c96dfe6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-01_ee1b8e9afbe684d9dcf05512c96dfe6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 772KB

2026-08-01_ee1b8e9afbe684d9dcf05512c96dfe6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 128150ce60473154c0923ab1aafcad2b
SHA256 5064ecd08dd3990aa41e171676187a5cff04b22a981df34ed77323609464c27e
MD5 ee1b8e9afbe684d9dcf05512c96dfe6d
SHA1 a6e9a34cf7328c4b0d624de6c1ab8b4fd59bf701
SHA512 883232ecc0834c60a2e7a96f0be3514f5a01d23123367c04f23a916b54761ac2c62c684d76e40370aceea4e6bc4ae94fd9a0bc17082fadba75defc89ff69c10c
SSDEEP 12288:Y34iccTLfVbYisdDDCnGKcSRpGCwFy0WlIOcgZFbHMy7mvnO3leMpIs7UpHP8Rco:Yoi/HVB/sNIoHkRcwfYLwqNEotje
TLSH
T1B1F47C3E669901E8E5B7E175C9AA5A06F7F1740A1235960F73F80B6A1F37B305F2A310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing many references to VEEAM. Observed in ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

367872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptFinishHash BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCreateHash

ws2_32

gethostname

advapi32

ChangeServiceConfigW AdjustTokenPrivileges CloseServiceHandle RegCloseKey RegQueryValueExA GetUserNameA RegCreateKeyExW RegSetValueExW RegOpenKeyExW QueryServiceStatusEx OpenServiceW LookupPrivilegeValueW CheckTokenMembership EnumServicesStatusExW FreeSid OpenProcessToken EnumDependentServicesW ControlService AllocateAndInitializeSid OpenSCManagerW

user32

SetLayeredWindowAttributes GetAsyncKeyState SetWindowLongW ShowWindow SetWindowPos GetWindowLongW SystemParametersInfoW GetSystemMetrics

shell32

ShellExecuteW CommandLineToArgvW SHChangeNotify SHGetFolderPathW

kernel32

HeapReAlloc HeapSize GetTimeZoneInformation GetFileAttributesExW ReadConsoleW GetSystemTimeAsFileTime GetVolumeInformationW IsDebuggerPresent MultiByteToWideChar ReadFile GetFileSizeEx WriteFile VirtualAlloc SetEndOfFile CloseHandle SetFilePointerEx MoveFileExW GetLogicalDrives GetConsoleScreenBufferInfo SetPriorityClass SetConsoleTextAttribute GetCommandLineW GetCurrentProcess GetStdHandle ReleaseSemaphore SetConsoleMode GetConsoleCursorInfo DeviceIoControl GetModuleFileNameW SetThreadPriority CreateMutexW WaitForSingleObject CreateFileW IsValidCodePage CreateEventW GetConsoleMode GetLastError SetConsoleCursorInfo SetFileInformationByHandle FillConsoleOutputCharacterW GetDiskFreeSpaceExW GetCurrentThread DeleteFileW ResetEvent GetOverlappedResult WriteConsoleW LocalFree ExitProcess GlobalMemoryStatusEx CreateProcessW CreateSemaphoreW CopyFileW SetConsoleCursorPosition GetDriveTypeW SetConsoleScreenBufferSize SetCurrentConsoleFontEx GetTempPathW SetFileAttributesW GetConsoleWindow CreateProcessA lstrcmpiW SetConsoleTitleW GetExitCodeProcess FindFirstFileExW FindFirstVolumeW FindNextFileW GetQueuedCompletionStatus lstrlenA FindClose GetFileAttributesW PostQueuedCompletionStatus GetSystemInfo SetVolumeMountPointW FindVolumeClose GetVolumePathNamesForVolumeNameW InterlockedPushEntrySList FindNextVolumeW InitializeSListHead CreateIoCompletionPort InterlockedPopEntrySList HeapAlloc GetLogicalDriveStringsA GetProcAddress GetProcessHeap GetModuleHandleW WideCharToMultiByte GetComputerNameExA GetDiskFreeSpaceExA GetComputerNameA FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx DecodePointer EncodePointer SleepConditionVariableSRW SleepConditionVariableCS SetStdHandle EnumSystemLocalesW SetEnvironmentVariableW FreeEnvironmentStringsW GetACP GetOEMCP GetUserDefaultLCID IsValidLocale WakeAllConditionVariable WakeConditionVariable GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileType HeapFree GetConsoleOutputCP FlushFileBuffers GetCommandLineA FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException GetCurrentProcessId GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx GetLocaleInfoEx GetEnvironmentStringsW GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId WaitForSingleObjectEx Sleep GetExitCodeThread InitializeConditionVariable

shlwapi

StrStrIW PathAppendW

winhttp

WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpReceiveResponse WinHttpOpenRequest WinHttpCrackUrl WinHttpOpen

pdh

PdhOpenQueryW PdhGetFormattedCounterValue PdhCollectQueryData PdhAddCounterW

iphlpapi

GetIfTable GetAdaptersInfo

dwmapi

DwmSetWindowAttribute

mpr

WNetGetUniversalNameW

gdiplus

GdipCreateFontFamilyFromName GdipCloneImage GdipDeleteBrush GdipAlloc GdipDisposeImage GdipSetSmoothingMode GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipDeleteFontFamily GdipFree GdipDrawRectangleI GdipCloneBrush GdipGetImageGraphicsContext GdipFillRectangleI GdipGetImageEncodersSize GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipDeletePen GdipCreateBitmapFromScan0 GdipCreatePen1 GdipSetStringFormatAlign GdipSaveImageToFile GdipDrawString GdipGetImageEncoders GdipCreateStringFormat GdiplusShutdown GdiplusStartup GdipGetGenericFontFamilySansSerif

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader RtlUnwind

Name

.text

Size

572KB

Virtual Size

571KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

163KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_ee1b8e9afbe684d9dcf05512c96dfe6d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

bcrypt

ws2_32

advapi32

user32

shell32

kernel32

shlwapi

winhttp

pdh

iphlpapi

dwmapi

mpr

gdiplus

ntdll

generic