2026-08-03_4771ace09576c6d523aab3c6a2a53268_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_4771ace09576c6d523aab3c6a2a53268_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 716KB
Sample260804-pcdg2swsez
SHA256 c67a552ddd3bfde677a67104e7d0ec5f56e4576543b415e1183971bab2fdde3d
MD5 4771ace09576c6d523aab3c6a2a53268
SHA1 50d2e29ee13bb744d69486871be7c6dd6d843a8a
SHA512 98c5b39e83bc9c60190647d6283a2daf25006a96286463af4684f29a0d52be210b1847b248ebc71aa3c5caaede6efd40895216593e7c7197ae2e00f26c7b83a6
SSDEEP 12288:kV9ay0HTvZ9FUvJUyZIfaAtZ9ex2OkczGV89d8xTCGIyBwRk81Rj:eUhTvZ9FUvJUKBkcs89dCTC0SRF1
TLSH
T1C2F44B1766A902FDE0BBE17899065E02E7B5B81A03B19EDF07D005672F976E09F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Custom signature

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_4771ace09576c6d523aab3c6a2a53268_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-08-03_4771ace09576c6d523aab3c6a2a53268_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 716KB

2026-08-03_4771ace09576c6d523aab3c6a2a53268_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 7344e19cf97d107ae81ffa5cfd25af81
SHA256 c67a552ddd3bfde677a67104e7d0ec5f56e4576543b415e1183971bab2fdde3d
MD5 4771ace09576c6d523aab3c6a2a53268
SHA1 50d2e29ee13bb744d69486871be7c6dd6d843a8a
SHA512 98c5b39e83bc9c60190647d6283a2daf25006a96286463af4684f29a0d52be210b1847b248ebc71aa3c5caaede6efd40895216593e7c7197ae2e00f26c7b83a6
SSDEEP 12288:kV9ay0HTvZ9FUvJUyZIfaAtZ9ex2OkczGV89d8xTCGIyBwRk81Rj:eUhTvZ9FUvJUKBkcs89dCTC0SRF1
TLSH
T1C2F44B1766A902FDE0BBE17899065E02E7B5B81A03B19EDF07D005672F976E09F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

497204

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdiplusShutdown GdiplusStartup GdipSaveImageToStream

mf

MFEnumDeviceSources

ole32

CoInitializeSecurity CoUninitialize CoCreateInstance CoInitializeEx CoSetProxyBlanket CreateStreamOnHGlobal CLSIDFromString CoTaskMemFree

oleaut32

VariantClear SysAllocStringLen SysAllocString SysFreeString VariantInit SysAllocStringByteLen SysStringByteLen

shell32

SHFileOperationW SHGetFolderPathW ShellExecuteA

advapi32

CheckTokenMembership RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation RegDeleteTreeW GetSidSubAuthorityCount AllocateAndInitializeSid GetSidSubAuthority FreeSid RegQueryValueExW GetUserNameW RegDeleteValueW

user32

GetForegroundWindow mouse_event keybd_event CallNextHookEx GetSystemMetrics VkKeyScanA OpenInputDesktop PeekMessageW MapVirtualKeyA MessageBoxA UnhookWindowsHookEx TranslateMessage ClipCursor SetWindowsHookExW SendMessageW SetThreadDesktop ReleaseDC DispatchMessageW ToUnicode AttachThreadInput GetAsyncKeyState GetKeyboardState GetDC MapVirtualKeyW GetWindowThreadProcessId EnumDisplayDevicesW ExitWindowsEx

gdi32

DeleteObject DeleteDC CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt CreateDIBSection

mfplat

MFShutdown MFCreateMediaType MFCreateAttributes MFStartup

mfreadwrite

MFCreateSourceReaderFromMediaSource

kernel32

GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW EnumSystemLocalesW HeapReAlloc SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap FlushFileBuffers GetFileType HeapAlloc HeapFree GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW VirtualQuery LoadLibraryExA FlushInstructionCache RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead CreateEventW ResetEvent SetEvent GetCurrentProcessId ReadFile FindFirstFileW GetFileSizeEx FindNextFileW WriteFile FindClose CreateFileW DeleteFileW CloseHandle MoveFileExW ExitProcess Sleep CreateDirectoryW SetHandleInformation CreatePipe WaitForSingleObject GetFileAttributesW SetFileAttributesW GetLastError GetFileAttributesExW CreateProcessW CopyFileW CreateProcessA MoveFileW GetExitCodeProcess GetCurrentProcess TerminateProcess ExpandEnvironmentStringsA OpenProcess CreateToolhelp32Snapshot Process32NextW CreateFileA Process32FirstW GetProcAddress GetModuleHandleW LocalFree VirtualProtect VirtualAlloc GetModuleFileNameW CreateMutexW LoadLibraryA IsDebuggerPresent ExpandEnvironmentStringsW GetTempPathW GetSystemDirectoryW MultiByteToWideChar GetComputerNameW WideCharToMultiByte GetCurrentThreadId GetTickCount64 GetSystemInfo GlobalMemoryStatusEx InitializeCriticalSectionAndSpinCount GetStringTypeW GetCPInfo CompareStringEx WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime

Name

.text

Size

686KB

Virtual Size

686KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_4771ace09576c6d523aab3c6a2a53268_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

gdiplus

mf

ole32

oleaut32

shell32

advapi32

user32

gdi32

mfplat

mfreadwrite

kernel32

generic