2026-08-07_3add7970ee22702e806e5514932c88e0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_3add7970ee22702e806e5514932c88e0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.4MB
Sample260807-gr57lsec55
SHA256 f72ea22fecdf776418b7dbf477872cc1d43d472f89c70d0a37f563b74d284c9d
MD5 3add7970ee22702e806e5514932c88e0
SHA1 96b4ce88b037bf291ba528a026f64d8de513b73a
SHA512 d783f59c37d3d685dc12a9129edd4f1430b042201cc9c62b870d99e0c6b3eba62910aac0db6cb679196cb5be496fe62314bb1f59aa161ecd416b6253f1cc40f1
SSDEEP 12288:mDM/RVOCRJF3Cgo4MF5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:kccuJc7/JnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1AE6507D6D2CC3778C3666CB885B1081F933B3D4E060286D657E278E64B3B56A8BFD215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_3add7970ee22702e806e5514932c88e0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-07_3add7970ee22702e806e5514932c88e0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.4MB

2026-08-07_3add7970ee22702e806e5514932c88e0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH f7731726bdb8cf7621303f994c671703
SHA256 f72ea22fecdf776418b7dbf477872cc1d43d472f89c70d0a37f563b74d284c9d
MD5 3add7970ee22702e806e5514932c88e0
SHA1 96b4ce88b037bf291ba528a026f64d8de513b73a
SHA512 d783f59c37d3d685dc12a9129edd4f1430b042201cc9c62b870d99e0c6b3eba62910aac0db6cb679196cb5be496fe62314bb1f59aa161ecd416b6253f1cc40f1
SSDEEP 12288:mDM/RVOCRJF3Cgo4MF5GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWu:kccuJc7/JnQ/tbw/2Mkjy6Fr7g0ou
TLSH
T1AE6507D6D2CC3778C3666CB885B1081F933B3D4E060286D657E278E64B3B56A8BFD215
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\Jenkins\workspace\LPMD_len0268_master\pdb\Release\x64\LPlatSvc.pdb

kernel32

GetCurrentProcess GetTickCount64 WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP TerminateProcess IsValidCodePage FindNextFileW FindFirstFileExW FindClose EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FreeLibrary GetProcAddress LoadLibraryExW DisconnectNamedPipe ReadFile ConnectNamedPipe CreateNamedPipeW ResetEvent WaitNamedPipeW SetEvent Sleep WTSGetActiveConsoleSessionId CancelWaitableTimer SetWaitableTimer CreateWaitableTimerW LocalAlloc WriteFile lstrlenW GetCurrentProcessId ProcessIdToSessionId CreateThread WaitForMultipleObjects CreateEventW GetModuleFileNameW LocalFree lstrcmpiW DeviceIoControl CreateFileW SetLastError GetLastError FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetACP CloseHandle GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx RaiseException HeapFree InitializeCriticalSectionEx HeapSize HeapReAlloc HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap GetSystemPowerStatus CallNamedPipeW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateMutexW CreateProcessW OpenMutexW WaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection EncodePointer CompareStringEx GetCPInfo LCMapStringEx OutputDebugStringW

user32

EndPaint BeginPaint PostQuitMessage EndDialog DestroyWindow DialogBoxParamW RegisterRawInputDevices RegisterPowerSettingNotification ShowWindow SendMessageW RegisterClassExW LoadCursorW LoadIconW DispatchMessageW DefWindowProcW TranslateAcceleratorW GetMessageW LoadAcceleratorsW LoadStringW GetRawInputDeviceInfoW FindWindowW CreateWindowExW GetRawInputData UpdateWindow TranslateMessage

advapi32

AdjustTokenPrivileges RegQueryValueExW ChangeServiceConfigW StartServiceW QueryServiceStatusEx DeleteService QueryServiceStatus ControlService OpenServiceW CloseServiceHandle CreateServiceW OpenSCManagerW ImpersonateLoggedOnUser SetTokenInformation DuplicateTokenEx RegOpenKeyExW LookupPrivilegeValueW OpenProcessToken CreateProcessAsUserW RevertToSelf RegCreateKeyExW DeregisterEventSource ReportEventW RegisterEventSourceW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RegCloseKey RegSetValueExW

shell32

CommandLineToArgvW

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSQuerySessionInformationW

userenv

CreateEnvironmentBlock

hid

HidD_GetAttributes

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW

shlwapi

PathFindExtensionW

powrprof

GetCurrentPowerPolicies CallNtPowerInformation

ole32

CoInitializeEx CoUninitialize CoCreateInstance CoInitializeSecurity

oleaut32

VariantInit VariantClear SysAllocString SysFreeString SysStringByteLen SysAllocStringByteLen

Name

.text

Size

197KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

556KB

Virtual Size

555KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_3add7970ee22702e806e5514932c88e0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

advapi32

shell32

wtsapi32

userenv

hid

setupapi

shlwapi

powrprof

ole32

oleaut32

generic