2026-08-03_9e9337c1f59f20e3b3476fa2080582a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_9e9337c1f59f20e3b3476fa2080582a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.0MB
Sample260804-mlb98shf23
SHA256 1587a9f18f3a72274765ae1529265c6b1c9018914a26703e9240bff15ff4bdf4
MD5 9e9337c1f59f20e3b3476fa2080582a0
SHA1 4e8609d99da16a580288198149833b90b1c71a81
SHA512 c36dfbf31383861592f2b818c0be4dd26cdc5be06f08a1d653411b0cbbd1dc7eb474d150c84fc7a1306909fbaaef9dde97066a499ec497c753d1b5d27c92b716
SSDEEP 12288:jGlQ/j84C5uszprFW0EgExdeT4mPr05nK+PZE9O2bJIC0fDNNbr:jGlQ/gdu8pr1EgwdeU5nK+O93l0fZ5
TLSH
T12C35AE5AB3E800F8E0779136C9926607EB767C2907309BDF139416696F736D09F3A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_9e9337c1f59f20e3b3476fa2080582a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-03_9e9337c1f59f20e3b3476fa2080582a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.0MB

2026-08-03_9e9337c1f59f20e3b3476fa2080582a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 2720d4a1f95c9138ad8bd9939997906c
SHA256 1587a9f18f3a72274765ae1529265c6b1c9018914a26703e9240bff15ff4bdf4
MD5 9e9337c1f59f20e3b3476fa2080582a0
SHA1 4e8609d99da16a580288198149833b90b1c71a81
SHA512 c36dfbf31383861592f2b818c0be4dd26cdc5be06f08a1d653411b0cbbd1dc7eb474d150c84fc7a1306909fbaaef9dde97066a499ec497c753d1b5d27c92b716
SSDEEP 12288:jGlQ/j84C5uszprFW0EgExdeT4mPr05nK+PZE9O2bJIC0fDNNbr:jGlQ/gdu8pr1EgwdeU5nK+O93l0fZ5
TLSH
T12C35AE5AB3E800F8E0779136C9926607EB767C2907309BDF139416696F736D09F3A722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

383160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpSendRequest WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpReceiveResponse WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable

kernel32

DeviceIoControl CreateFileW CloseHandle ReadFile GetModuleFileNameA Process32First VirtualFree GetCurrentProcess WriteFile VirtualAlloc LoadLibraryExA Thread32Next Thread32First GetModuleHandleA CreateToolhelp32Snapshot Sleep GetLastError LoadLibraryA DeleteFileW Process32Next LoadLibraryW GetLocalTime GetWindowsDirectoryW Beep GetProcAddress GetFileSize FreeLibrary GetConsoleWindow MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter HeapReAlloc OutputDebugStringW ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW IsValidLocale SetEndOfFile LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc SetFilePointerEx GetFileSizeEx CreateProcessW GetExitCodeProcess WaitForSingleObject HeapFree GetCommandLineW GetCommandLineA WriteConsoleW GetModuleFileNameW GetFileType GetStdHandle FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent SetEnvironmentVariableW GetProcessHeap SetStdHandle GetUserDefaultLCID HeapSize IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetLocaleInfoW FindFirstFileExW LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW RtlUnwind FindNextFileW GetFileAttributesExW AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo

user32

GetCursorPos TranslateMessage DefWindowProcA EnumWindows PostQuitMessage PeekMessageA SetClipboardData UnhookWindowsHookEx GetKeyState GetMessageExtraInfo LoadCursorA ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData MessageBoxA GetWindowThreadProcessId DispatchMessageA DestroyWindow IsWindowVisible SetWindowPos SetWindowRgn CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow PostThreadMessageA SetWindowsHookExA GetWindowTextA SetWindowDisplayAffinity

gdi32

CreateRoundRectRgn

shell32

ShellExecuteW ShellExecuteA

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlImageNtHeader

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

571KB

Virtual Size

570KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

275KB

Virtual Size

282KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_9e9337c1f59f20e3b3476fa2080582a0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

d3d11

winhttp

kernel32

user32

gdi32

shell32

ntdll

imm32

d3dcompiler_47

generic