2026-08-08_bbd391871462117e9c775d69699c3ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_bbd391871462117e9c775d69699c3ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 9.1MB
Sample260808-jjdthacd53
SHA256 98cefda9291ae70e814669c2f33020e21d77a193a84c1d9e7261a7f6b94c7742
MD5 bbd391871462117e9c775d69699c3ca7
SHA1 f97dbaa957373c015f70996422ad8fa8fa1980fa
SHA512 08e8033393ec0309235a47b3c52bde4be38d48e7c7265bd1ce9ed66635a43fdcdebcc673729ee72e7541adcef09a8f5e7a5f1a5891a04b4660df623ba726a102
SSDEEP 196608:5vSbL4ibyLnbcHL3QtmTCRVndGMy6L91CJMDtyb++:g0xnArgtmTCRVndGMb5s6Ryq+
TLSH
T199A60187E3A600F9E0A78B3051422D4FB899B6B68AA9755F34C40C85DD72EC4B54DBF3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_bbd391871462117e9c775d69699c3ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-08_bbd391871462117e9c775d69699c3ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 9.1MB

2026-08-08_bbd391871462117e9c775d69699c3ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH bfacdef95c117bade26ae87c18414e39
SHA256 98cefda9291ae70e814669c2f33020e21d77a193a84c1d9e7261a7f6b94c7742
MD5 bbd391871462117e9c775d69699c3ca7
SHA1 f97dbaa957373c015f70996422ad8fa8fa1980fa
SHA512 08e8033393ec0309235a47b3c52bde4be38d48e7c7265bd1ce9ed66635a43fdcdebcc673729ee72e7541adcef09a8f5e7a5f1a5891a04b4660df623ba726a102
SSDEEP 196608:5vSbL4ibyLnbcHL3QtmTCRVndGMy6L91CJMDtyb++:g0xnArgtmTCRVndGMb5s6Ryq+
TLSH
T199A60187E3A600F9E0A78B3051422D4FB899B6B68AA9755F34C40C85DD72EC4B54DBF3
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

428052

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadLibraryExA FreeLibrary ReadFile LocalAlloc LocalFree K32GetModuleFileNameExW OpenProcess MultiByteToWideChar UnmapViewOfFile CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetModuleFileNameA GetCommandLineW GetModuleHandleExW RtlVirtualUnwind GetModuleFileNameW RtlLookupFunctionEntry GetSystemDirectoryW GlobalSize FileTimeToSystemTime GlobalAlloc GlobalLock CreateProcessA GetTickCount GlobalUnlock MulDiv SetConsoleTitleW LoadLibraryExW GetSystemTimePreciseAsFileTime GetCurrentProcess WriteConsoleW HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle CreatePipe HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID GetCurrentProcessId CreateEventW GetExitCodeProcess FormatMessageA CreateProcessW DeleteFileW Sleep GetModuleHandleA GetFileAttributesW CreateFileW WaitForSingleObject GetTempPathW GetConsoleWindow ExitProcess GetTempPathA DeviceIoControl VirtualAlloc VirtualFree GetLogicalProcessorInformation GetModuleHandleW GetProcAddress CloseHandle Process32Next DeleteFileA CreateFileA GetFileAttributesA GetLastError CreateToolhelp32Snapshot FindClose WriteFile GetStdHandle IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapFree HeapAlloc GetCommandLineA TerminateProcess Process32First GetFileType DuplicateHandle TlsFree TlsSetValue RtlUnwind TlsGetValue TlsAlloc SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx GetStringTypeW GetCPInfo CompareStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte QueryPerformanceFrequency CreateDirectoryW FindFirstFileExW FindNextFileW GetFileAttributesExW SetEndOfFile SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree

user32

SetProcessDPIAware GetWindowLongPtrA GetDlgItem SendMessageA SetDlgItemTextA SetLayeredWindowAttributes wsprintfW SetDlgItemTextW GetMonitorInfoW SetTimer GetAsyncKeyState ShowWindow SendMessageW GetDC LoadImageA DefWindowProcW MessageBoxW wsprintfA wvsprintfA SetWindowLongPtrA SendDlgItemMessageW

gdi32

CreateSolidBrush SetBkColor CreateFontA SelectObject GetDIBits GetDeviceCaps DeleteDC SetTextColor SetBkMode

advapi32

SetFileSecurityA RegSetValueExW CreateServiceA CloseServiceHandle OpenSCManagerA DeleteService ControlService StartServiceA CheckTokenMembership OpenServiceA RegQueryValueExA RegOpenKeyExA RegQueryValueExW SetSecurityDescriptorDacl SetEntriesInAclA AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor RegCreateKeyExW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegCloseKey RegDeleteKeyW RegOpenKeyExW

shell32

SHGetKnownFolderPath ShellExecuteA

ole32

CoTaskMemFree GetHGlobalFromStream CreateStreamOnHGlobal

iphlpapi

GetAdaptersAddresses

shlwapi

SHDeleteKeyW

dbghelp

ImageDirectoryEntryToData

ntdll

NtQuerySystemInformation RtlCaptureContext

ws2_32

WSAGetLastError send socket connect recv freeaddrinfo setsockopt

gdiplus

GdipGetImageHeight GdipAlloc GdipCloneImage GdiplusStartup GdipCreateBitmapFromStream GdipGetImageEncoders GdipDrawImageI GdipCreateBitmapFromScan0 GdipSaveImageToStream GdipGetImageWidth GdipGetImageEncodersSize GdipGetImageGraphicsContext GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP

uxtheme

SetWindowTheme

Name

.text

Size

617KB

Virtual Size

616KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.sdata

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

J{T

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_bbd391871462117e9c775d69699c3ca7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

gdi32

advapi32

shell32

ole32

iphlpapi

shlwapi

dbghelp

ntdll

ws2_32

gdiplus

uxtheme

generic