wall_stealer | 2026-08-01_93583558c7e736a9819fc2ee0edeec19_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_93583558c7e736a9819fc2ee0edeec19_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 2.4MB
Sample260801-flcsfaek4v
SHA256 563a008d58ca3f862d3b9857e0a95043f20bdf8bfb3bd612457f46a8d733462b
MD5 93583558c7e736a9819fc2ee0edeec19
SHA1 a86b9e03e86b6c9b362e86d2f5cd8e86f9c2f926
SHA512 e47cbb2bdf8285359205f03fb1bcbff253d23c0e83d01c5fe489bcb445d22b2a04abd802c88937f73e04c0cc35ad19e4436e459cea949344b740874b33228024
SSDEEP 49152:XEXoJaQM3ZR0yEZCejniBShZpHuPFWz3TBEkujyukBklFM6ek1rf:XGoJ7r9mPpXk2lFh
TLSH
T191B59E02E69649DDC47BC0F4C5157A67F4BE38240628AF376AD80B647BD2B3097ED34A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer wall_stealer

Malware Config

Signatures

Family: WallStealer,VoidStealer,TheVoidStealer
WallStealer aka VoidStealer is an information stealer.
stealer wall_stealer

Detects WallStealer aka VoidStealer 1 IoCs

resource	yara_rule
sample	family_wallstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_93583558c7e736a9819fc2ee0edeec19_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-01_93583558c7e736a9819fc2ee0edeec19_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 2.4MB

2026-08-01_93583558c7e736a9819fc2ee0edeec19_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH 0a60e5c14c8ed8eded1ae63abc2ca390
SHA256 563a008d58ca3f862d3b9857e0a95043f20bdf8bfb3bd612457f46a8d733462b
MD5 93583558c7e736a9819fc2ee0edeec19
SHA1 a86b9e03e86b6c9b362e86d2f5cd8e86f9c2f926
SHA512 e47cbb2bdf8285359205f03fb1bcbff253d23c0e83d01c5fe489bcb445d22b2a04abd802c88937f73e04c0cc35ad19e4436e459cea949344b740874b33228024
SSDEEP 49152:XEXoJaQM3ZR0yEZCejniBShZpHuPFWz3TBEkujyukBklFM6ek1rf:XGoJ7r9mPpXk2lFh
TLSH
T191B59E02E69649DDC47BC0F4C5157A67F4BE38240628AF376AD80B647BD2B3097ED34A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects WallStealer aka VoidStealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1670656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CreateStreamOnHGlobal

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

advapi32

CryptGetHashParam OpenProcessToken ConvertSidToStringSidW GetTokenInformation GetCurrentHwProfileW RegCloseKey GetSidSubAuthorityCount AllocateAndInitializeSid GetSidSubAuthority RegEnumKeyExW FreeSid CheckTokenMembership RegOpenKeyExW GetUserNameW InitializeSecurityDescriptor GetUserNameA SetSecurityDescriptorDacl CryptReleaseContext CryptAcquireContextW CryptDestroyHash CryptHashData CryptCreateHash RegQueryValueExW

crypt32

CryptUnprotectData CryptStringToBinaryA

gdiplus

GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipGetImageEncodersSize GdipSaveImageToStream GdipCloneImage GdiplusShutdown GdiplusStartup GdipGetImageEncoders

kernel32

ReadConsoleW HeapReAlloc GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetDriveTypeA GetWindowsDirectoryA ReadFile GetModuleFileNameA SetNamedPipeHandleState GetOEMCP GetSystemDefaultLCID SetLastError GetCommandLineW GetFullPathNameW GetCurrentProcess lstrlenW GetCPInfo LoadLibraryExA GetModuleFileNameW CreateNamedPipeW GetUserDefaultUILanguage GetFullPathNameA GetEnvironmentVariableW GetTempPathW lstrlenA GetEnvironmentVariableA GetCurrentThreadId GetSystemDirectoryW GetCurrentDirectoryA GetModuleHandleA GetSystemDefaultLangID GetACP DisconnectNamedPipe GetCommandLineA CreateEventW MultiByteToWideChar Sleep GetTempPathA GetTickCount64 GetLastError GetFileAttributesA GetThreadUILanguage SetEvent GetSystemDirectoryA LoadLibraryA LoadLibraryW CancelIoEx GetOverlappedResult GetWindowsDirectoryW GetProcAddress GetProcessHeap GetModuleHandleW GetFileType GetTickCount GetEnvironmentStringsW ConnectNamedPipe FindFirstFileW FindNextFileW FindClose GetCurrentProcessorNumber LocalFree CreateProcessW IsValidCodePage QueryDosDeviceW WaitForSingleObject CloseHandle CreateThread GetCurrentProcessId GetLargePageMinimum OpenProcess CreateProcessA VirtualQueryEx FindFirstFileA HeapFree GetSystemDefaultUILanguage FindNextFileA LocalAlloc GetFileAttributesW CopyFileA DeleteFileA GlobalAlloc GlobalFree HeapAlloc RemoveDirectoryA CreateDirectoryA GetFileAttributesExW GetVolumeInformationW GetLocaleInfoW CreateToolhelp32Snapshot GetTimeZoneInformation GetLogicalProcessorInformationEx Process32NextW Process32FirstW GetSystemInfo GlobalMemoryStatusEx GetComputerNameA Module32FirstW Module32NextW WaitForDebugEvent TerminateProcess DebugActiveProcessStop SuspendThread ResumeThread ContinueDebugEvent GetThreadContext DebugActiveProcess ReadProcessMemory SetThreadContext OpenThread GetCurrentThread WriteProcessMemory RtlUnwind VirtualAlloc CreateMutexW ReleaseMutex GetExitCodeThread VirtualProtectEx VirtualAllocEx FlushInstructionCache CreateRemoteThread VirtualFreeEx OpenMutexW FlushFileBuffers LoadLibraryExW VirtualProtect WriteFile GetStdHandle ExitProcess IsProcessorFeaturePresent UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection WideCharToMultiByte VirtualFree EnterCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime FormatMessageA SleepConditionVariableSRW WaitForSingleObjectEx GetLocaleInfoEx FindFirstFileExW GetFinalPathNameByHandleW CreateFile2 AreFileApisANSI GetFileInformationByHandleEx

user32

ReleaseDC GetSystemMetrics GetDC GetKeyboardLayoutList EnumDisplayDevicesA SetProcessDPIAware GetCursorPos MessageBoxW

gdi32

BitBlt DeleteObject DeleteDC GetDeviceCaps CreateCompatibleDC SelectObject CreateCompatibleBitmap

shell32

SHGetFolderPathW SHGetKnownFolderPath

ws2_32

inet_ntop closesocket getaddrinfo WSAStartup freeaddrinfo htons htonl send socket connect recv

winhttp

WinHttpQueryHeaders WinHttpSetOption WinHttpQueryDataAvailable WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpReadData WinHttpSetTimeouts WinHttpConnect

iphlpapi

GetAdaptersAddresses

shlwapi

PathFindFileNameW

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

535KB

Virtual Size

536KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

10KB

Virtual Size

32.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_93583558c7e736a9819fc2ee0edeec19_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

ole32

oleaut32

advapi32

crypt32

gdiplus

kernel32

user32

gdi32

shell32

ws2_32

winhttp

iphlpapi

shlwapi

generic