2026-08-03_c7d4c9ef1e3eaeef6a77612a358369bd_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_c7d4c9ef1e3eaeef6a77612a358369bd_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar
Size 1.5MB
Sample260804-lsf2bsxbjb
SHA256 7a52c48466205a6d1cae92825c990430bcba66457d377642b5e56a80795aad30
MD5 c7d4c9ef1e3eaeef6a77612a358369bd
SHA1 782e5a418ddc5f69605a3d4342200a14155e91be
SHA512 19ce7145031a64350f8eea6e6302ecb56b4fecd3ccd7af0d55bc0e2ad2918b41cb5091f3b34503e04a3d1c5da220f51533cb4a0d58bc40c132673dc7b1a441c4
SSDEEP 24576:bKh00zsE+8ofLx3hFKBDWonrvmXUv4kAoHjto1GFxlXutIs1WZX5AR:bI0jiof9xABDWurmkv4kBT/M+w
TLSH
T11D658B26F7DC20FBE4A693B745554582F6B178090324B7CB0A9CC3D96F7A6F09E3A214
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_c7d4c9ef1e3eaeef6a77612a358369bd_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-08-03_c7d4c9ef1e3eaeef6a77612a358369bd_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

.exe 1.5MB

2026-08-03_c7d4c9ef1e3eaeef6a77612a358369bd_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 11745195e50dc16b1e791ff951f0ec79
SHA256 7a52c48466205a6d1cae92825c990430bcba66457d377642b5e56a80795aad30
MD5 c7d4c9ef1e3eaeef6a77612a358369bd
SHA1 782e5a418ddc5f69605a3d4342200a14155e91be
SHA512 19ce7145031a64350f8eea6e6302ecb56b4fecd3ccd7af0d55bc0e2ad2918b41cb5091f3b34503e04a3d1c5da220f51533cb4a0d58bc40c132673dc7b1a441c4
SSDEEP 24576:bKh00zsE+8ofLx3hFKBDWonrvmXUv4kAoHjto1GFxlXutIs1WZX5AR:bI0jiof9xABDWurmkv4kBT/M+w
TLSH
T11D658B26F7DC20FBE4A693B745554582F6B178090324B7CB0A9CC3D96F7A6F09E3A214
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

179764

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Projects\SoundEdge\APO\x64\Release\SECOMN64.exe.pdb

oleaut32

VariantClear VariantInit VARIANT_UserUnmarshal64 VARIANT_UserFree64 VARIANT_UserMarshal VARIANT_UserSize VARIANT_UserUnmarshal VARIANT_UserFree VARIANT_UserMarshal64 VARIANT_UserSize64

rpcrt4

RpcBindingVectorFree RpcEpUnregister RpcServerUnregisterIf RpcServerListen RpcEpRegisterW NdrServerCall2 RpcServerInqBindings RpcServerRegisterIf3 NdrServerCallAll RpcServerUseProtseqEpW I_RpcBindingInqLocalClientPID

kernel32

WaitForSingleObject SetEvent CreateThread HeapReAlloc GetFileSizeEx GetModuleFileNameW FreeLibrary ReadFile SetStdHandle GetProcessHeap GetCurrentThreadId GetCurrentProcess FindFirstFileW CloseHandle HeapSize IsDebuggerPresent IsProcessorFeaturePresent LoadLibraryW CreateEventW FreeResource SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP WaitForMultipleObjects FindClose DecodePointer ResumeThread CreateMutexExW Sleep GetACP GetProcAddress GetModuleHandleW SetLastError GetTimeZoneInformation QueryPerformanceCounter GetConsoleMode GetFileType EnumSystemLocalesW FindNextFileW FindResourceW SizeofResource WTSGetActiveConsoleSessionId GetUserDefaultLCID LockResource IsValidLocale CreateProcessW ConnectNamedPipe WriteFile DisconnectNamedPipe DuplicateHandle LoadResource CreateNamedPipeW GetLocaleInfoW OpenProcess LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapFree HeapAlloc GetCommandLineW GetCommandLineA OutputDebugStringW FormatMessageW GetStdHandle DeleteCriticalSection InitializeCriticalSectionEx RaiseException CreateThreadpoolWork SubmitThreadpoolWork TerminateProcess FreeLibraryAndExitThread ExitThread GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader MultiByteToWideChar LocalFree LocalAlloc GetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter GetConsoleOutputCP SetThreadPriority ReleaseMutex LeaveCriticalSection EnterCriticalSection WriteConsoleW GetProductInfo TryEnterCriticalSection CreateFileW GetModuleHandleA IsValidCodePage WideCharToMultiByte FlushFileBuffers RtlUnwindEx GetCPInfo GetStartupInfoW CompareStringEx GetLocaleInfoEx FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx EncodePointer GetExitCodeThread WaitForSingleObjectEx QueryPerformanceFrequency GetCurrentProcessId AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable GetStringTypeW SetFilePointerEx FindFirstFileExW InitializeSListHead GetSystemTimeAsFileTime InitializeCriticalSection

ole32

StringFromCLSID CoTaskMemFree CoCreateInstance CoInitializeEx CoCreateGuid

advapi32

RegOpenKeyExW DeleteService QueryServiceStatus ControlService OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW EventWriteString SetServiceStatus EventUnregister EventRegister RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx SetEntriesInAclW CreateProcessAsUserW FreeSid AllocateAndInitializeSid RegDeleteValueW EqualSid GetTokenInformation OpenProcessToken SetSecurityDescriptorDacl InitializeSecurityDescriptor RegDeleteKeyW RegQueryValueExW RegCloseKey

user32

PostQuitMessage DefWindowProcW GetWindowLongPtrW MessageBoxW DispatchMessageW TranslateMessage GetMessageW CreateWindowExW RegisterClassW GetClassInfoW PostMessageW SetWindowLongPtrW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification WTSQueryUserToken

secomn64

SEAPOCOMAPI_StartReceiveConfigChange SEAPOCOMAPI_ReceiveConfigChange SEAPOCOMAPI_CancelReceiveConfigChange SEAPOCOMAPI_CancelReceiveParamChange SEAPOCOMAPI_ReceiveParamChange SEAPOCOMAPI_ReceiveParamChangeEx SEMISCAPI_GetDefaultBrowser SEAPOCOMAPI_StartReceiveStateChange SEAPOCOMAPI_ReceiveStateChange SEAPOCOMAPI_CancelReceiveStateChange SEAPOCOMAPI_DeactivateEndpoint SEAPOCOMAPI_ActivateEndpoint SEAPOCOMAPI_ResetUserParameter SEAPOCOMAPI_ResetUserParametersEx SEAPOCOMAPI_GetUserParameterI32 SEAPOCOMAPI_GetUserParameter SEAPOCOMAPI_SetUserParameterEx SEAPOCOMAPI_SetUserParameterI32 SEAPOCOMAPI_SetUserParameter SEAPOCOMAPI_GetDetectedContentType SEAPOCOMAPI_RegGetContentTypeAlias SEAPOCOMAPI_RegFreeContentTypes SEAPOCOMAPI_RegGetContentTypes SEAPOCOMAPI_DeleteUserProfile SEAPOCOMAPI_CopyUserProfile SEAPOCOMAPI_GetUserProfileAlias SEAPOCOMAPI_SetUserProfileAlias SEAPOCOMAPI_GetUserProfileW SEAPOCOMAPI_GetUserProfile SEAPOCOMAPI_SetUserProfileW SEMISCAPI_OpenBrowser SEAPOCOMAPI_FreeProfileNames SEAPOCOMAPI_GetUserProfiles SEAPOCOMAPI_GetEngine SEAPOCOMAPI_GetEngineDefaultConfig SEAPOCOMAPI_SetEngine SEAPOCOMAPI_SetEndpointFxPropertyValueEx2 SEAPOCOMAPI_SetEndpointFxPropertyValueEx SEAPOCOMAPI_SetEndpointFxPropertyValue SEAPOCOMAPI_GetEndpointFxPropertyValueEx2 SEAPOCOMAPI_GetEndpointFxPropertyValueEx SEAPOCOMAPI_GetEndpointFxPropertyValue SEAPOCOMAPI_GetEndpointEx SEAPOCOMAPI_GetEndpoint SEAPOCOMAPI_GetEndpointPropertyValue SEAPOCOMAPI_SetEndpointVolume SEAPOCOMAPI_GetUserParameterEx SEAPOCOMAPI_GetEndpointVolume SEAPOCOMAPI_FreeIOConfigs SEAPOCOMAPI_FreeContentTypes SEAPOCOMAPI_GetContentType SEAPOCOMAPI_SetIOConfig SEAPOCOMAPI_GetIOConfigs SEAPOCOMAPI_GetIOConfig SEAPOCOMAPI_GetLastError SEAPOCOMAPI_InitializeAPI SEAPOCOMAPI_FreeAPI SEAPOCOMAPI_FreeEndpointIDs SEAPOCOMAPI_FreeEndpoint SEAPOCOMAPI_SetDetectedContentType SEAPOCOMAPI_SetContentType SEAPOCOMAPI_SetAPOType SEAPOCOMAPI_GetEndpoint2 SEAPOCOMAPI_GetEndpointIDsEx SEAPOCOMAPI_InitializeAPIEx SEMISCAPI_IsBrowserExtensionInstalled SEAPOCOMAPI_GetWindowsLastError SEAPOCOMAPI_StartReceiveDataChange SEAPOCOMAPI_CancelReceiveDataChange SEAPOCOMAPI_ReceiveDataChange SEAPOCOMAPI_SetUserProfile SEAPOCOMAPI_StartReceiveParamChange SEAPOCOMAPI_GetContentTypes

ntdll

RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry

Name

.text

Size

523KB

Virtual Size

522KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

170KB

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

186KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_c7d4c9ef1e3eaeef6a77612a358369bd_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

oleaut32

rpcrt4

kernel32

ole32

advapi32

user32

version

userenv

api-ms-win-security-base-l1-2-2

wtsapi32

secomn64

ntdll

generic