2026-08-02_4517b569c918a3ea2a190f701c15fb2d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_4517b569c918a3ea2a190f701c15fb2d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar
Size 885KB
Sample260802-kqqbjsfh22
SHA256 e2e46bc9dd1af092e7290bf00652a0e3de527496351b1a26f5a9f04ffdafeba9
MD5 4517b569c918a3ea2a190f701c15fb2d
SHA1 32cf7dc1a358f95e24dddce99f741462ef11e385
SHA512 dff67ff1a3eb6b0358cf681fa85fa89dc69212aabd1854893113bbee50faa7cc1ae9a652050b19813ec363084d25ac754c524e94edb14eb63b08da5d13e1d184
SSDEEP 24576:qDKg6uqRPjmuSjeTZC40G4GujGGC5SYCI:qDKg6zZmjeTkvG4Il
TLSH
T1B215392DE6A801AAF16E9279EC550706E3B37F15037196CB32A076591F376E08F3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-02_4517b569c918a3ea2a190f701c15fb2d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

.exe 885KB

2026-08-02_4517b569c918a3ea2a190f701c15fb2d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 9f444d1e729430a72e1801033977e72e
SHA256 e2e46bc9dd1af092e7290bf00652a0e3de527496351b1a26f5a9f04ffdafeba9
MD5 4517b569c918a3ea2a190f701c15fb2d
SHA1 32cf7dc1a358f95e24dddce99f741462ef11e385
SHA512 dff67ff1a3eb6b0358cf681fa85fa89dc69212aabd1854893113bbee50faa7cc1ae9a652050b19813ec363084d25ac754c524e94edb14eb63b08da5d13e1d184
SSDEEP 24576:qDKg6uqRPjmuSjeTZC40G4GujGGC5SYCI:qDKg6zZmjeTkvG4Il
TLSH
T1B215392DE6A801AAF16E9279EC550706E3B37F15037196CB32A076591F376E08F3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

d6:56:d2:b7:74:56:d2:1b:ef:d8:64:8a:86:b6:27:7b:d0:3b:e1:9c:b1:29:81:de:17:33:97:72:b6:1a:aa:22

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Chains

Jun 2, 2025

CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Serial Number

09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2023 - Jan 16, 2026

Subject

Serial Number

38:63:de:f8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 24, 1999 - Jul 24, 2029

Subject

Serial Number

58:da:13:ff:00:00:00:00:51:ce:0d:f7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 22, 2015 - Jun 22, 2029

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,C=US

Serial Number

98:40:7c:5e:16:cf:87:c1:e9:c1:ff:f9:b4:0a:88:8d

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 22, 2025 - Jun 21, 2029

Minor OS version

Major OS version

Entry point

212240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

FCAT_DT_Capture_x64.pdb

kernel32

GetModuleFileNameA SetLastError GetFullPathNameW GetModuleFileNameW LocalAlloc CreateFileW GetFileAttributesW GetSystemDirectoryW GetLastError CloseHandle GetProcAddress LocalFree VerSetConditionMask CreateProcessW GetModuleHandleW FreeLibrary VerifyVersionInfoW LoadLibraryExW CreateDirectoryW SetConsoleCtrlHandler EnterCriticalSection GetCommandLineW SetConsoleTitleA RegisterWaitForSingleObject UnregisterWait OutputDebugStringA LeaveCriticalSection InitializeCriticalSection GetCurrentThreadId CreateEventW Sleep AttachConsole OutputDebugStringW SetEvent QueryPerformanceFrequency ResetEvent GetLocalTime DeleteCriticalSection GetCurrentProcessId lstrcmpiW QueryPerformanceCounter AllocConsole HeapFree SetDefaultDllDirectories CreateMutexW WaitForSingleObject GetCurrentDirectoryA UnmapViewOfFile CreateThread HeapAlloc CreateFileMappingA GetProcessHeap lstrcpyW OpenFileMappingA MapViewOfFile MulDiv WritePrivateProfileStringW GetCurrentProcess GetPrivateProfileIntW LoadLibraryExA GetPrivateProfileStringW WaitForMultipleObjects OpenProcess DeleteFileW MoveFileExW FormatMessageA CreateEventA SetEndOfFile WriteConsoleW HeapSize GetTimeZoneInformation HeapReAlloc SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadFile ReadConsoleW PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleMode SetFilePointerEx RaiseException GetSystemInfo VirtualProtect VirtualQuery RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead MultiByteToWideChar GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetFileInformationByHandleEx WideCharToMultiByte GetStringTypeW TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo RtlUnwindEx RtlPcToFileHeader InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetConsoleCP ExitProcess GetModuleHandleExW ExitThread FreeLibraryAndExitThread GetStdHandle WriteFile GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx RtlUnwind

ole32

CoTaskMemFree

shlwapi

PathFileExistsW

bcrypt

BCryptImportKeyPair BCryptVerifySignature BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyKey

Name

.text

Size

545KB

Virtual Size

544KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

137KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

872B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_4517b569c918a3ea2a190f701c15fb2d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

kernel32

ole32

shlwapi

bcrypt

generic