2026-08-03_4dfb6b63a76dc3c15054e178201fb0cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_4dfb6b63a76dc3c15054e178201fb0cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 436KB
Sample260804-dfkvratzfs
SHA256 2df1b751422a40e4037faef4f3073abacff2699ce541dad278f19f85879d3afb
MD5 4dfb6b63a76dc3c15054e178201fb0cb
SHA1 95492c05ecc83b53518315444cf933b7f953d89e
SHA512 ee4ea2c09068ec6ca0473455fee2088f0a6c8cb57dc86e920deb80938a17635492abeedf673e7e03981ed1bdd040776a191811792cb1e12fcee684b5776a93cc
SSDEEP 6144:F0jxaVsVSJisMi/WHHg+KTzrUd+Mb+HYHvsPZ7U+2A:FUaKxji/WvKTzrjMHgpUZ
TLSH
T1F6941808EA91C4A9D1EA8334C56343F2E525FC99DF6389EB6264FD693E33DC06938711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_4dfb6b63a76dc3c15054e178201fb0cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-08-03_4dfb6b63a76dc3c15054e178201fb0cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 436KB

2026-08-03_4dfb6b63a76dc3c15054e178201fb0cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH df513fa37df881a5e8aa55f4e1aff5c8
SHA256 2df1b751422a40e4037faef4f3073abacff2699ce541dad278f19f85879d3afb
MD5 4dfb6b63a76dc3c15054e178201fb0cb
SHA1 95492c05ecc83b53518315444cf933b7f953d89e
SHA512 ee4ea2c09068ec6ca0473455fee2088f0a6c8cb57dc86e920deb80938a17635492abeedf673e7e03981ed1bdd040776a191811792cb1e12fcee684b5776a93cc
SSDEEP 6144:F0jxaVsVSJisMi/WHHg+KTzrUd+Mb+HYHvsPZ7U+2A:FUaKxji/WvKTzrjMHgpUZ
TLSH
T1F6941808EA91C4A9D1EA8334C56343F2E525FC99DF6389EB6264FD693E33DC06938711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

419840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType HeapAlloc HeapFree GetModuleHandleExW ExitProcess GetModuleFileNameW WriteFile GetStdHandle RaiseException EncodePointer LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RtlUnwindEx GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LCMapStringW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode CloseHandle CreateFileW RegisterApplicationRestart VirtualProtect GlobalUnlock CreateProcessW UnregisterApplicationRestart GlobalLock WriteConsoleW GlobalAlloc OutputDebugStringW GetPrivateProfileSectionNamesW GetLocaleInfoW GetPrivateProfileSectionW SetDllDirectoryW LocalFree GlobalFree GetPrivateProfileStringW SetSearchPathMode SetDefaultDllDirectories RtlPcToFileHeader WritePrivateProfileStringW

user32

DeleteMenu MonitorFromWindow GetPropW IsWindowVisible InsertMenuItemW GetWindow CheckMenuRadioItem GetMenuItemInfoW EnableWindow EndPaint BeginPaint GetCursorPos GetMessageW GetWindowThreadProcessId UpdateWindow DrawFrameControl PtInRect RegisterWindowMessageW GetParent DrawEdge EnableMenuItem GetKeyNameTextW DrawIconEx SetRect DrawTextW GetDlgItem GetClientRect GetComboBoxInfo GetWindowDC DrawMenuBar GetClassNameW SetPropW BringWindowToTop SetFocus IntersectRect EnumWindows PostQuitMessage GetSysColor DrawFocusRect TrackMouseEvent SetWindowPlacement MapWindowPoints GetDlgCtrlID GetMonitorInfoW RedrawWindow SetTimer GetCapture OffsetRect ShowWindow GetSubMenu GetWindowPlacement GetMenuBarInfo GetWindowLongPtrW GetSystemMetrics EndDialog ScreenToClient GetIconInfo LoadAcceleratorsW SetWindowLongPtrW EnumChildWindows MonitorFromRect SetWindowPos GetDC InflateRect DestroyWindow GetFocus GetMenu GetWindowRect MapVirtualKeyW CallWindowProcW AllowSetForegroundWindow DefWindowProcW IsIconic SetForegroundWindow SystemParametersInfoW CreateDialogIndirectParamW CheckMenuItem TrackPopupMenuEx SetClipboardData ChangeWindowMessageFilterEx TranslateMessage TranslateAcceleratorW DrawTextExW MoveWindow IsWindowEnabled GetForegroundWindow SendDlgItemMessageW FrameRect EmptyClipboard DestroyAcceleratorTable SetMenuItemInfoW CloseClipboard CreateIconIndirect DestroyIcon SendMessageW KillTimer SetCursor LoadCursorW DestroyMenu RegisterHotKey ClientToScreen CreatePopupMenu LoadMenuW UnregisterHotKey DialogBoxIndirectParamW InvalidateRect IsDialogMessageW DispatchMessageW OpenClipboard GetActiveWindow GetClassLongPtrW ReleaseDC

gdi32

SetPixelV GetDeviceCaps GetTextExtentExPointW ExtTextOutW SetDCPenColor RoundRect CreateBitmap Rectangle BitBlt SelectObject CreateCompatibleBitmap CreateCompatibleDC GetStockObject DeleteDC SetTextColor CreateFontIndirectW CreateSolidBrush DeleteObject SetBkColor ExcludeClipRect SetDCBrushColor GetObjectW CreateDIBSection SetBkMode SelectClipRgn

comdlg32

ChooseFontW ChooseColorW

shell32

SHAppBarMessage SHGetKnownFolderPath Shell_NotifyIconW CommandLineToArgvW ShellExecuteW ShellExecuteExW

ole32

CoUninitialize CoInitializeEx CoCreateInstance CoTaskMemFree

oleaut32

SysFreeString SysAllocString

ntdll

RtlFreeHeap RtlMultiByteToUnicodeSize RtlCreateHeap RtlQueryPerformanceCounter NtSetThreadExecutionState NtCreateMutant NtQueryInformationFile RtlSetHeapInformation RtlRaiseStatus NtCreateKeyedEvent NtQueryInformationThread NtSetSystemInformation LdrAccessResource NtQueryValueKey RtlExpandEnvironmentStrings_U NtOpenFile RtlEqualSid RtlGetDaclSecurityDescriptor NtMapViewOfSection RtlInterlockedPopEntrySList NtQueryDefaultLocale NtWaitForSingleObject NtSetValueKey NtUnmapViewOfSection NtQuerySecurityObject NtQueryDirectoryFile NtCreateFile RtlOpenCurrentUser RtlMultiByteToUnicodeN RtlFindMessage NtWaitForKeyedEvent RtlGetVersion RtlInitAnsiString NtFlushBuffersFile RtlRunOnceBeginInitialize RtlInitUnicodeStringEx NtDeviceIoControlFile NtQueryAttributesFile RtlUTF8ToUnicodeN RtlLengthSid NtDeleteValueKey NtDelayExecution RtlReAllocateHeap LdrGetDllHandleEx NtQueryInformationToken NtReleaseKeyedEvent LdrLoadDll NtSetInformationThread NtReadFile LdrFindResource_U NtSetInformationFile LdrUnloadDll NtCreateThreadEx RtlFreeUnicodeString RtlGetAce RtlDosPathNameToNtPathName_U_WithStatus RtlDowncaseUnicodeChar RtlUpcaseUnicodeChar RtlTimeToTimeFields LdrGetProcedureAddressEx NtOpenKeyEx RtlRandomEx NtReleaseMutant NtWriteFile NtQuerySystemInformation NtCreateSection RtlDosSearchPath_Ustr RtlAllocateHeap RtlInitializeSListHead NtOpenProcessToken RtlInterlockedPushEntrySList NtAdjustPrivilegesToken NtOpenMutant NtResumeThread NtSetInformationProcess NtClose RtlSetUnhandledExceptionFilter NtTerminateThread RtlRunOnceComplete NtQueryInformationProcess RtlExitUserProcess RtlInitUnicodeString

comctl32

InitCommonControlsEx ImageList_Draw ImageList_GetIconSize ord381 ord345

dwmapi

DwmSetWindowAttribute

dbghelp

MiniDumpWriteDump

shlwapi

PathUnquoteSpacesW ord354 StrFormatByteSizeEx StrTrimW

uxtheme

GetThemeFont GetThemeBackgroundContentRect DrawThemeEdge BeginBufferedAnimation BufferedPaintRenderAnimation DrawThemeBackground GetThemePartSize CloseThemeData IsThemeBackgroundPartiallyTransparent DrawThemeParentBackground GetThemeTransitionDuration SetWindowTheme EndBufferedAnimation DrawThemeTextEx OpenThemeData

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpCrackUrl WinHttpConnect WinHttpSetStatusCallback WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpQueryHeaders

Name

.text

Size

245KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

51KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_4dfb6b63a76dc3c15054e178201fb0cb_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

kernel32

user32

gdi32

comdlg32

shell32

ole32

oleaut32

ntdll

comctl32

dwmapi

dbghelp

shlwapi

uxtheme

winhttp

generic