2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

General

Target
2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 268KB
Sample260802-mk49ma1bja
SHA256 f0e70c9e9169e8df4be60e24a2dad319b58d7d97a01868f9c5da7b3bd230583c
MD5 e74692578127715c5e1fa0f4978dcc8c
SHA1 08c579a2b5c3162c98aecbc4965c63d89e83ae57
SHA512 3a67763843cab85ff949632e73739ad037cba2485c9ef0bfee0d77cf1fc0859f2eb2c0e0338c791dfc86c35b1278159fa6e9f53ea186864a33bac46f08403481
SSDEEP 6144:zbcvLL+JL3n6Gsri+NIOuXtaIe20ezxy/:zbrrnJsriJO0aIm
TLSH
T16B447D15B7A50CF9ED67867DCC425906EA72BC174760E78F03A04A971F236E09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 268KB

2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 0997b2050e8fed2cf5dcdb12a7ca21cd
SHA256 f0e70c9e9169e8df4be60e24a2dad319b58d7d97a01868f9c5da7b3bd230583c
MD5 e74692578127715c5e1fa0f4978dcc8c
SHA1 08c579a2b5c3162c98aecbc4965c63d89e83ae57
SHA512 3a67763843cab85ff949632e73739ad037cba2485c9ef0bfee0d77cf1fc0859f2eb2c0e0338c791dfc86c35b1278159fa6e9f53ea186864a33bac46f08403481
SSDEEP 6144:zbcvLL+JL3n6Gsri+NIOuXtaIe20ezxy/:zbrrnJsriJO0aIm
TLSH
T16B447D15B7A50CF9ED67867DCC425906EA72BC174760E78F03A04A971F236E09E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

45760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\kevin\Desktop\cavetool\files\SeroLocker\x64\Release\SeroLocker.pdb

kernel32

ReadFile GetLogicalDrives FindFirstFileExW FindNextFileW WriteFile FindClose CreateFileW DeleteFileA CloseHandle GetFileSize GetDriveTypeW WriteConsoleW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage WideCharToMultiByte GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc RtlUnwind

user32

MessageBoxA

bcrypt

BCryptGenerateSymmetricKey BCryptDestroyKey BCryptEncrypt BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_e74692578127715c5e1fa0f4978dcc8c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

bcrypt

generic