wall_stealer | 2026-08-08_6b80b014e37532fb79d5f5ea62088816_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_6b80b014e37532fb79d5f5ea62088816_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc
Size 562KB
Sample260808-fmfwgs1arb
SHA256 b49fde05cdd9646ab64e86f544985e3d974b09183579e87baa9584ccdf1b5bbf
MD5 6b80b014e37532fb79d5f5ea62088816
SHA1 7ccff53b5d53a245af8173d465b4863b139ca30e
SHA512 4f9fa84836595420b402099bec8cfd4f2c9852621e35b6a78332651155d535b779e125c05490c81f76c382e7209e793925b3b15c4f0edea123d33a88432e2f89
SSDEEP 6144:c51M5vchJEUptMiBxbBkZoiy1eP9Wdm5fgeCTULCIuY/7xx6DuKv00TXz:c51M5cjptHBx9Go2Pr+3Iuudx3KvX
TLSH
T113C47C1DE6A402F9D1A7C5B4CE434517E772BC0A4731A69B13E18E972F237A05B3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer wall_stealer

Malware Config

Signatures

Family: WallStealer,VoidStealer,TheVoidStealer
WallStealer aka VoidStealer is an information stealer.
stealer wall_stealer

Detects WallStealer aka VoidStealer 1 IoCs

resource	yara_rule
sample	family_wallstealer

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_6b80b014e37532fb79d5f5ea62088816_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

File Explorer

2026-08-08_6b80b014e37532fb79d5f5ea62088816_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

.exe 562KB

2026-08-08_6b80b014e37532fb79d5f5ea62088816_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

IMPHASH f9114234e212fccea3f6c5645ff009cd
SHA256 b49fde05cdd9646ab64e86f544985e3d974b09183579e87baa9584ccdf1b5bbf
MD5 6b80b014e37532fb79d5f5ea62088816
SHA1 7ccff53b5d53a245af8173d465b4863b139ca30e
SHA512 4f9fa84836595420b402099bec8cfd4f2c9852621e35b6a78332651155d535b779e125c05490c81f76c382e7209e793925b3b15c4f0edea123d33a88432e2f89
SSDEEP 6144:c51M5vchJEUptMiBxbBkZoiy1eP9Wdm5fgeCTULCIuY/7xx6DuKv00TXz:c51M5cjptHBx9Go2Pr+3Iuudx3KvX
TLSH
T113C47C1DE6A402F9D1A7C5B4CE434517E772BC0A4731A69B13E18E972F237A05B3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects WallStealer aka VoidStealer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

264856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CreateStreamOnHGlobal

oleaut32

SysFreeString VariantInit SysAllocString VariantClear

advapi32

CryptReleaseContext GetSidSubAuthorityCount AllocateAndInitializeSid GetSidSubAuthority GetUserNameA FreeSid CheckTokenMembership RegOpenKeyExW RegQueryValueExW CryptAcquireContextW CryptCreateHash ConvertSidToStringSidW GetTokenInformation InitializeSecurityDescriptor SetSecurityDescriptorDacl RegCloseKey CryptGetHashParam CryptDestroyHash CryptHashData

crypt32

CryptUnprotectData CryptStringToBinaryA

gdiplus

GdipSaveImageToStream GdiplusStartup GdiplusShutdown GdipGetImageEncoders GdipCloneImage GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipGetImageEncodersSize

kernel32

GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW GetConsoleMode ReadFile SetNamedPipeHandleState CreateNamedPipeW GetUserDefaultUILanguage DisconnectNamedPipe CreateEventW MultiByteToWideChar GetLastError SetEvent CancelIoEx GetOverlappedResult ConnectNamedPipe FindFirstFileW FindNextFileW FindClose LocalFree CreateProcessW WideCharToMultiByte OpenProcess GetFileAttributesA CreateProcessA VirtualQueryEx FindFirstFileA HeapFree FindNextFileA LocalAlloc GetFileAttributesW CopyFileA DeleteFileA GlobalAlloc GlobalFree HeapAlloc RemoveDirectoryA GetProcessHeap CreateDirectoryA GetFileAttributesExW GetTempPathA GetLocaleInfoW GetVersionExW GetTimeZoneInformation GetSystemInfo GetProcAddress GlobalMemoryStatusEx GetModuleHandleW GetComputerNameExA GetComputerNameA LoadLibraryW Module32FirstW Module32NextW VirtualFree GetCurrentProcess VirtualAlloc CreateMutexW ReleaseMutex GetModuleHandleA CreateToolhelp32Snapshot GetExitCodeThread Process32NextW Process32FirstW CloseHandle OpenMutexW IsValidLocale LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect SetStdHandle RtlUnwind CreateFileW HeapSize WriteConsoleW SetEndOfFile Sleep UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle GetModuleFileNameW TerminateProcess ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary GetConsoleOutputCP QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime FormatMessageA GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WaitForSingleObjectEx GetLocaleInfoEx FindFirstFileExW GetFinalPathNameByHandleW CreateFile2 AreFileApisANSI GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FlushFileBuffers

user32

GetDC ReleaseDC GetSystemMetrics GetKeyboardLayout EnumDisplayDevicesA MessageBoxW

gdi32

BitBlt DeleteObject CreateCompatibleDC SelectObject CreateCompatibleBitmap DeleteDC

shell32

SHGetFolderPathW SHGetKnownFolderPath

winhttp

WinHttpConnect WinHttpSendRequest WinHttpSetTimeouts WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpSetOption WinHttpQueryHeaders WinHttpAddRequestHeaders

Name

.text

Size

423KB

Virtual Size

424KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

111KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_6b80b014e37532fb79d5f5ea62088816_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc

ole32

oleaut32

advapi32

crypt32

gdiplus

kernel32

user32

gdi32

shell32

winhttp

generic