2026-08-03_2531c314e5d860e688f2c7210edf1587_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_2531c314e5d860e688f2c7210edf1587_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 1.1MB
Sample260804-dqa4asvsb1
SHA256 23a0173af989a53e184a3173802469908408278dc80b84b98e31565a0e78cf7a
MD5 2531c314e5d860e688f2c7210edf1587
SHA1 d2295f37f1568eb1773590884b3b09a7d7e78f26
SHA512 013e88f6b5dc979c3e331ed0406484d215633b6bf45ee2c65eed83d2fdb5382fb96c2cd41593c466ddae3fae4612b4111bd2be2fc617a9c43927d5f953e3dda2
SSDEEP 24576:RklYllYkiDaIKR9hh97tkrpPne87HtO/DF1+9codjeWyZxeCEi:Rke4Vaxbx7tkVR2TPod5
TLSH
T19735F22577D502F4E47B813889964663F6B1B8251378FFDF06988A521F33AE04B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_2531c314e5d860e688f2c7210edf1587_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-08-03_2531c314e5d860e688f2c7210edf1587_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 1.1MB

2026-08-03_2531c314e5d860e688f2c7210edf1587_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 2809a0b06626ae0927b92f7f4702c3bf
SHA256 23a0173af989a53e184a3173802469908408278dc80b84b98e31565a0e78cf7a
MD5 2531c314e5d860e688f2c7210edf1587
SHA1 d2295f37f1568eb1773590884b3b09a7d7e78f26
SHA512 013e88f6b5dc979c3e331ed0406484d215633b6bf45ee2c65eed83d2fdb5382fb96c2cd41593c466ddae3fae4612b4111bd2be2fc617a9c43927d5f953e3dda2
SSDEEP 24576:RklYllYkiDaIKR9hh97tkrpPne87HtO/DF1+9codjeWyZxeCEi:Rke4Vaxbx7tkVR2TPod5
TLSH
T19735F22577D502F4E47B813889964663F6B1B8251378FFDF06988A521F33AE04B7EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

203040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ssh-agent.pdb

libcrypto

BN_bin2bn DSA_generate_parameters_ex DSA_SIG_free BN_dup RSA_generate_key_ex BN_set_flags RSA_public_decrypt RSA_new RSA_set0_crt_params RSA_free BN_free BN_set_word RSA_sign BN_div RSA_set0_factors RSA_get0_factors RSA_get0_crt_params RSA_set0_key BN_CTX_new BN_CTX_free EVP_sha384 EVP_md5 EVP_sha256 EVP_Digest DSA_generate_key EVP_sha1 DSA_get0_pqg EVP_sha512 EVP_CIPHER_CTX_key_length EVP_CIPHER_CTX_new EVP_aes_256_cbc DSA_set0_pqg DSA_SIG_new EVP_CipherInit EVP_aes_128_ctr DSA_new DSA_SIG_get0 DSA_set0_key DSA_do_verify BN_bn2bin EVP_aes_256_ctr DSA_get0_key DSA_do_sign DSA_free DSA_SIG_set0 EC_POINT_point2oct EVP_des_ede3_cbc EVP_aes_192_cbc EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_set_key_length EVP_aes_192_ctr EVP_Cipher EVP_aes_256_gcm EVP_aes_128_gcm EVP_CIPHER_CTX_free ECDSA_do_sign EC_POINT_cmp EC_KEY_set_private_key EC_KEY_generate_key ECDSA_SIG_get0 EC_KEY_set_public_key EC_KEY_free ECDSA_SIG_free ECDSA_SIG_set0 EC_KEY_set_asn1_flag ECDSA_do_verify EC_KEY_new_by_curve_name ECDSA_SIG_new RSA_blinding_on EC_GROUP_get_order BN_clear_free BN_value_one EC_METHOD_get_field_type EC_POINT_mul EC_POINT_get_affine_coordinates_GFp EC_KEY_set_group EC_POINT_is_at_infinity arc4random_buf RSA_get0_key EC_POINT_free EVP_aes_128_cbc EC_KEY_get0_public_key EC_GROUP_free EC_POINT_new EC_GROUP_cmp EC_GROUP_set_asn1_flag EC_GROUP_get_curve_name BN_new EC_KEY_get0_private_key EC_KEY_get0_group BN_cmp BN_sub explicit_bzero EC_GROUP_new_by_curve_name EC_GROUP_method_of BN_num_bits EC_KEY_METHOD_set_sign RSA_up_ref d2i_ECDSA_SIG EC_KEY_set_method RSA_meth_set_priv_enc EC_KEY_METHOD_get_sign RSA_meth_set1_name RSA_set_method RSA_meth_dup RSA_size RSA_get_default_method EC_POINT_oct2point EC_KEY_METHOD_new EC_KEY_up_ref EC_KEY_OpenSSL

kernel32

GetCommandLineW GetCommandLineA GetCurrentDirectoryW SetCurrentDirectoryW SetEnvironmentVariableW RtlPcToFileHeader RaiseException EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError RtlUnwindEx GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SetStdHandle LoadLibraryExW ReadConsoleOutputA SetConsoleCursorPosition GetConsoleWindow Beep FillConsoleOutputAttribute WriteConsoleOutputA ReadConsoleInputW SetConsoleCursorInfo SetConsoleWindowInfo GetConsoleCursorInfo ScrollConsoleScreenBufferA GetConsoleOutputCP SetConsoleScreenBufferSize SetConsoleTextAttribute FillConsoleOutputCharacterA CreateWaitableTimerA WriteConsoleW CancelSynchronousIo GetConsoleMode SetConsoleMode WaitForSingleObjectEx WaitForMultipleObjectsEx ExitProcess FindClose FindFirstFileExW FindNextFileW CreateThread ExitThread GetFinalPathNameByHandleW FreeLibraryAndExitThread QueueUserAPC VerifyVersionInfoW VerSetConditionMask ResetEvent SleepEx ReadFileEx CreateFileA SetConsoleCtrlHandler GetModuleFileNameW HeapFree HeapAlloc GetLastError FlsAlloc FlsGetValue FlsSetValue SetHandleInformation FlsFree CreateNamedPipeW WaitForMultipleObjects InitializeCriticalSectionEx GetNamedPipeClientProcessId VirtualProtect GetQueuedCompletionStatus OpenProcess CompareStringW LCMapStringW SetEvent CloseHandle GetCurrentProcessId CreateProcessW CreateEventA CreateIoCompletionPort ConnectNamedPipe ReadFile WriteFile CancelIoEx GetOverlappedResult HeapReAlloc GetStringTypeW LocalFree ReadConsoleW GetFileSizeEx GetFullPathNameW IsValidCodePage WriteFileEx GetCurrentProcess GetStdHandle TerminateProcess GetACP GetModuleHandleExW SetEndOfFile GetCurrentThreadId DuplicateHandle GetTickCount64 SetFilePointerEx GetFileType CreateNamedPipeA CancelIo OpenThread FlushFileBuffers MultiByteToWideChar WideCharToMultiByte GetExitCodeProcess GetOEMCP GetConsoleScreenBufferInfo GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW WaitForSingleObject CreateFileW GetProcessHeap HeapSize GetLocalTime GetProcAddress GetComputerNameW FreeLibrary GetDriveTypeW ExpandEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW

advapi32

ConvertSidToStringSidW GetSidIdentifierAuthority EventWrite EventRegister CopySid IsValidSecurityDescriptor GetLengthSid LookupAccountNameW CreateProcessAsUserW RegDeleteTreeA RevertToSelf RegCloseKey RegOpenCurrentUser RegCreateKeyExA RegDeleteKeyExA RegEnumKeyExW ImpersonateLoggedOnUser RegDeleteTreeW RegOpenKeyExA RegOpenKeyExW RegQueryValueExW CreateWellKnownSid RegCreateKeyExW IsWellKnownSid RegSetValueExW OpenProcessToken CheckTokenMembership DuplicateToken ConvertStringSecurityDescriptorToSecurityDescriptorW DuplicateTokenEx GetTokenInformation OpenSCManagerW SetServiceStatus RegisterServiceCtrlHandlerW StartServiceA StartServiceCtrlDispatcherW OpenServiceW LookupAccountSidW

crypt32

CryptUnprotectData CryptStringToBinaryA CryptProtectData CryptBinaryToStringA

ws2_32

socket getsockname WSAStartup WSARecv WSASend WSAGetOverlappedResult setsockopt WSAGetLastError WSASocketW closesocket WSADuplicateSocketW

user32

ShowWindow GetWindowPlacement

Name

.text

Size

320KB

Virtual Size

319KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

196KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_2531c314e5d860e688f2c7210edf1587_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

libcrypto

kernel32

advapi32

crypt32

ws2_32

user32

generic