2026-08-04_bf1edb8433a8f99f2e1d39e1d3f45f0c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

General

Target
2026-08-04_bf1edb8433a8f99f2e1d39e1d3f45f0c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.4MB
Sample260804-garmwsdf98
SHA256 ffb503bd6817efe876f84aa2f0221c216d707d20b99a32fbb4f2fdc39c3c5abe
MD5 bf1edb8433a8f99f2e1d39e1d3f45f0c
SHA1 4cedcc8717af0c1af38d06a4bbc18b9eaa1a2087
SHA512 8f5f174d6f46b6dea2064f3279e81d63a4b61b834cf43756552f645d0f8e9bac9fad1107752b5f5f5228a399e754a485868c9c4210a5edcd19f87444213d6046
SSDEEP 24576:6Q4tYp58I1VQjw9f4boY60wtj1j0oWIxsstwNbObswo9YebIll0M/mb57GBiOl65:PQg8I1yjw9f4boY60wtjFxJt2iFaYejV
TLSH
T1A4659E6DA66C00A5E5BAD17CCB83650BE1F3740107724AEF03964A4A7F3BAF4563AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_bf1edb8433a8f99f2e1d39e1d3f45f0c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-04_bf1edb8433a8f99f2e1d39e1d3f45f0c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.4MB

2026-08-04_bf1edb8433a8f99f2e1d39e1d3f45f0c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 8646503b194cace152cc595a288b344c
SHA256 ffb503bd6817efe876f84aa2f0221c216d707d20b99a32fbb4f2fdc39c3c5abe
MD5 bf1edb8433a8f99f2e1d39e1d3f45f0c
SHA1 4cedcc8717af0c1af38d06a4bbc18b9eaa1a2087
SHA512 8f5f174d6f46b6dea2064f3279e81d63a4b61b834cf43756552f645d0f8e9bac9fad1107752b5f5f5228a399e754a485868c9c4210a5edcd19f87444213d6046
SSDEEP 24576:6Q4tYp58I1VQjw9f4boY60wtj1j0oWIxsstwNbObswo9YebIll0M/mb57GBiOl65:PQg8I1yjw9f4boY60wtjFxJt2iFaYejV
TLSH
T1A4659E6DA66C00A5E5BAD17CCB83650BE1F3740107724AEF03964A4A7F3BAF4563AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

528444

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\rel\gpu_drv\r610\r610_00\drivers\nvcamera\redist\_out\wddm2_amd64_release\ReShadeFXC64.pdb

kernel32

DeleteFileW WriteConsoleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead LocalFree FormatMessageA GetLocaleInfoEx CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI CloseHandle GetLastError GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapReAlloc HeapSize SetEndOfFile RtlUnwind

Name

.text

Size

730KB

Virtual Size

729KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

133KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

701B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_bf1edb8433a8f99f2e1d39e1d3f45f0c_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

generic