2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 1.2MB
Sample260804-dze4lsvtfv
SHA256 287471bea9812e51f9a69b3bf1627e37b15396604c209f411225104ce06a8ea3
MD5 1157baa211b23a89cf8daa155c378f1f
SHA1 42afcd90bae40607434941cf318459a626002ea1
SHA512 77d8b7398b42d9eaea8e09aff88a07834b23aab28a2ceb03651aac4af018c783d233dfc6c7fe1a8577d4306a6a3a1c7b48fb62772732a0507bf13b9cd9ae4709
SSDEEP 24576:6FlGpYoWd4yiHNbnnKs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0lfd4pNbKsLNiXicJFFRGNzj3
TLSH
T14045D056B3D012F9D0B7D13ACA568A61FBB2B8054720A7C703E45A592F277E14F3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 1.2MB

2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH fd6ae9e09e3b52523e46a9295a5cc590
SHA256 287471bea9812e51f9a69b3bf1627e37b15396604c209f411225104ce06a8ea3
MD5 1157baa211b23a89cf8daa155c378f1f
SHA1 42afcd90bae40607434941cf318459a626002ea1
SHA512 77d8b7398b42d9eaea8e09aff88a07834b23aab28a2ceb03651aac4af018c783d233dfc6c7fe1a8577d4306a6a3a1c7b48fb62772732a0507bf13b9cd9ae4709
SSDEEP 24576:6FlGpYoWd4yiHNbnnKs/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:0lfd4pNbKsLNiXicJFFRGNzj3
TLSH
T14045D056B3D012F9D0B7D13ACA568A61FBB2B8054720A7C703E45A592F277E14F3E316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

81336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\constructicon\builds\gfx\three\25.10\drivers\2d\dal\eeu\cmake_bridge\wNow64a\cmake_build\build\service\Release\atiesrxx.pdb

advapi32

CreateProcessAsUserA OpenThreadToken AdjustTokenPrivileges ImpersonateSelf LookupPrivilegeValueA CloseServiceHandle CreateServiceA DeleteService OpenSCManagerA OpenServiceA RegisterServiceCtrlHandlerExA SetServiceStatus StartServiceCtrlDispatcherA OpenProcessToken EventRegister EventUnregister EventWriteTransfer ImpersonateLoggedOnUser InitializeSecurityDescriptor RevertToSelf SetSecurityDescriptorDacl RegCloseKey RegOpenCurrentUser RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegOpenKeyExA RegSetValueExA RegSetValueExW RegGetValueA RegGetValueW RegEnumValueA SetEntriesInAclW FreeSid AllocateAndInitializeSid RegNotifyChangeKeyValue

wtsapi32

WTSFreeMemory WTSQuerySessionInformationA WTSEnumerateProcessesA WTSQueryUserToken

psapi

EnumProcessModules GetModuleInformation GetModuleBaseNameA

userenv

LoadUserProfileA UnloadUserProfile

powrprof

PowerReadDCValueIndex PowerEnumerate PowerReadACValueIndex PowerWriteACValueIndex PowerWriteDCValueIndex PowerGetActiveScheme PowerSetActiveScheme PowerSettingAccessCheck

setupapi

SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList CM_Reenumerate_DevNode CM_Locate_DevNodeA SetupDiSetClassInstallParamsA SetupDiGetHwProfileList SetupDiCallClassInstaller CM_Get_DevNode_Status CM_Get_Device_ID_ExA SetupDiGetDeviceRegistryPropertyA SetupDiGetClassDevsA

dwmapi

DwmIsCompositionEnabled

shlwapi

StrStrIA

kernel32

ReadConsoleW SetFilePointerEx GetFileSizeEx SetConsoleCtrlHandler GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW OutputDebugStringW WideCharToMultiByte GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect InitializeCriticalSectionEx IsThreadAFiber RtlCaptureStackBackTrace GetCurrentProcess FreeLibrary GetModuleHandleA GetProcAddress SetDefaultDllDirectories lstrcmpiA RegisterApplicationRecoveryCallback WaitForSingleObject GetSystemDirectoryA HeapSize UnmapViewOfFile CreateFileMappingA WTSGetActiveConsoleSessionId GetLastError GetCurrentThread GetModuleFileNameA GetFirmwareEnvironmentVariableA SetFirmwareEnvironmentVariableA FreeResource LoadResource LockResource FindResourceExA GetSystemDefaultLangID GetEnvironmentVariableA GetFileAttributesA CloseHandle TerminateProcess CreateProcessA OpenProcess QueryFullProcessImageNameA CreateToolhelp32Snapshot Process32First Process32Next SetEvent ResetEvent CreateEventA OpenEventA WaitForMultipleObjects LoadLibraryExA LoadLibraryA OutputDebugStringA GetLocalTime ReleaseMutex CreateMutexA OpenMutexA CreateThread SetThreadPriority TerminateThread LocalFree Sleep CreateFileA FlushFileBuffers ReadFile WriteFile ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeA VerSetConditionMask DeleteFileA FindClose FindFirstFileA FindNextFileA RemoveDirectoryA GetWindowsDirectoryA VerifyVersionInfoW GetCurrentProcessId GetPackageFamilyName ExpandEnvironmentStringsA QueryPerformanceCounter QueryPerformanceFrequency DeviceIoControl LocalAlloc FlsFree FlsSetValue FlsGetValue FlsAlloc GetTempPathW GetFileType HeapAlloc HeapFree GetCommandLineW GetCommandLineA GetModuleHandleExW ExitProcess HeapReAlloc WriteConsoleW SetEndOfFile CreateFileW MapViewOfFile GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer GetStdHandle GetModuleFileNameW RtlUnwind

user32

SetSysColors SystemParametersInfoA RegisterDeviceNotificationA UnregisterDeviceNotification RegisterPowerSettingNotification UnregisterPowerSettingNotification PostMessageA PostThreadMessageA GetSysColor RedrawWindow

Name

.text

Size

475KB

Virtual Size

475KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

114KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

memcpy_

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_c

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_d

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_1157baa211b23a89cf8daa155c378f1f_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

advapi32

wtsapi32

psapi

userenv

powrprof

setupapi

dwmapi

shlwapi

kernel32

user32

generic