2026-08-08_fc6ad59fb6f39a7260603d042cbcc580_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_fc6ad59fb6f39a7260603d042cbcc580_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 5.1MB
Sample260808-nfrcmswanb
SHA256 a524d91547fbb891a03cc4d53887cb8802ad76bdbd81de441e8d776d01f3ebbe
MD5 fc6ad59fb6f39a7260603d042cbcc580
SHA1 d551a02f9a2c2e7aedcf4f2501a7cde7110e14cd
SHA512 cc073f311a2e038e677d7c5a8c7f9e92377b2f9b7e4c56cb3ffb5cf3bbfe16fd9ecaf8100b367dd873fbbc53b2fe489603a634c68a5e3d69d8f2d5c59f900035
SSDEEP 49152:fjn2XGRtvhof7s1UnXy0++JWqmhFVdsJfogM5tO1FZMKcMUuYujOq+sh9Tiula7c:cpnUXnvu1jIshtYluLQLm
TLSH
T128465A0522EE0099F86AE57E8BA3C40BD67278944739A6FB01D1C29F1F37AD05F75722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_fc6ad59fb6f39a7260603d042cbcc580_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-08_fc6ad59fb6f39a7260603d042cbcc580_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 5.1MB

2026-08-08_fc6ad59fb6f39a7260603d042cbcc580_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH f668a589c8d54008bc214175aab2adbb
SHA256 a524d91547fbb891a03cc4d53887cb8802ad76bdbd81de441e8d776d01f3ebbe
MD5 fc6ad59fb6f39a7260603d042cbcc580
SHA1 d551a02f9a2c2e7aedcf4f2501a7cde7110e14cd
SHA512 cc073f311a2e038e677d7c5a8c7f9e92377b2f9b7e4c56cb3ffb5cf3bbfe16fd9ecaf8100b367dd873fbbc53b2fe489603a634c68a5e3d69d8f2d5c59f900035
SSDEEP 49152:fjn2XGRtvhof7s1UnXy0++JWqmhFVdsJfogM5tO1FZMKcMUuYujOq+sh9Tiula7c:cpnUXnvu1jIshtYluLQLm
TLSH
T128465A0522EE0099F86AE57E8BA3C40BD67278944739A6FB01D1C29F1F37AD05F75722
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2372464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\jenkins\workspace\MainRel4_Dell_VS2022\Consumer\MainRel4_Dell\Products\Release\x64\WavesSysSvc64.pdb

kernel32

SetEvent CloseHandle GetProcessHeap Sleep CreateEventW WideCharToMultiByte CreateDirectoryW RtlUnwind LocalFree WaitForSingleObject ResetEvent EnterCriticalSection LoadLibraryW LeaveCriticalSection InitializeCriticalSection LocalAlloc FreeLibrary GetThreadId GetProcAddress CreateTimerQueueTimer DeleteTimerQueueEx LoadLibraryA GetCurrentThread DeleteTimerQueueTimer CreateTimerQueue OutputDebugStringW GetTickCount64 MultiByteToWideChar DeleteCriticalSection HeapDestroy DecodePointer HeapAlloc FindResourceW GetCurrentProcess lstrlenW GetModuleHandleW ReadFile GetModuleHandleExW TerminateProcess GetModuleFileNameW K32GetModuleFileNameExW GetSystemPowerStatus CreateFileW OpenProcess CreateToolhelp32Snapshot ProcessIdToSessionId FormatMessageW Process32NextW Process32FirstW WTSGetActiveConsoleSessionId GetCurrentProcessId CreateProcessW QueryFullProcessImageNameW GetExitCodeProcess DeleteFileW K32EnumProcesses CreateThread SetDllDirectoryW WaitForMultipleObjects OpenEventW CreateMutexW GetSystemInfo ExpandEnvironmentStringsW DeviceIoControl OpenFileMappingW UnmapViewOfFile CreateFileMappingW MapViewOfFile GetTickCount ReleaseMutex GetCurrentDirectoryW CopyFileW FindFirstFileW FindNextFileW FindClose WriteFile LoadResource ReleaseSRWLockExclusive AcquireSRWLockExclusive TryEnterCriticalSection GetCurrentThreadId QueryPerformanceCounter QueryPerformanceFrequency FormatMessageA WaitForSingleObjectEx SwitchToThread GetExitCodeThread RtlPcToFileHeader IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW InitOnceComplete InitOnceBeginInitialize FlsAlloc FlsGetValue FlsSetValue FlsFree CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait EncodePointer LCMapStringEx CompareStringEx GetCPInfo GetLocaleInfoEx GetStringTypeW IsDebuggerPresent ConnectNamedPipe WaitNamedPipeW CreateIoCompletionPort GetSystemTime FindResourceExW RaiseException VerifyVersionInfoW SleepEx VerSetConditionMask GetOverlappedResult QueueUserAPC TerminateThread PostQueuedCompletionStatus PeekNamedPipe GetQueuedCompletionStatus CreateNamedPipeW HeapReAlloc LockResource GetLastError CreateWaitableTimerW SetWaitableTimer GetFirmwareEnvironmentVariableExW GetPhysicallyInstalledSystemMemory GetFileTime MoveFileExW SetFileAttributesW GetFileAttributesW RemoveDirectoryW LoadLibraryExA VirtualQuery HeapSize WriteConsoleW SetEndOfFile SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW GetFileAttributesExW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetTempPathW GetTimeZoneInformation GetFileType GetStdHandle ExitProcess ExitThread GetCommandLineW GetCommandLineA RtlUnwindEx InitializeCriticalSectionEx HeapFree InitializeSRWLock SizeofResource

user32

RegisterPowerSettingNotification UnregisterPowerSettingNotification CreateWindowExW MsgWaitForMultipleObjectsEx PeekMessageW DispatchMessageW SendMessageTimeoutW IsWindow ChangeWindowMessageFilterEx DestroyWindow PostThreadMessageW UnregisterClassW DefWindowProcW GetClassInfoW RegisterClassW RegisterWindowMessageW FindWindowExW GetMessageW TranslateMessage PostMessageW SendMessageW EndDialog KillTimer SetTimer

shlwapi

PathRemoveFileSpecW ord219 PathFileExistsW PathFindExtensionW SHDeleteKeyW

oleaut32

SysAllocStringLen SysAllocString SysFreeString SetErrorInfo VariantChangeType VariantInit VariantClear GetErrorInfo SysStringLen

ole32

CreateBindCtx CoUninitialize OleRun CoInitialize CoInitializeEx CoCreateFreeThreadedMarshaler CoTaskMemFree

api-ms-win-power-setting-l1-1-0

PowerWriteDCValueIndex PowerWriteACValueIndex PowerGetActiveScheme PowerSetActiveScheme

powrprof

PowerReadFriendlyName PowerReadDCValueIndex PowerReadACValueIndex

wtsapi32

WTSQueryUserToken WTSRegisterSessionNotification WTSUnRegisterSessionNotification

shell32

ShellExecuteW SHCreateDirectoryExW SHGetKnownFolderPath ShellExecuteExW SHGetSpecialFolderPathW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec

propsys

InitPropVariantFromStringVector InitPropVariantFromCLSID

netapi32

NetUserEnum NetApiBufferFree

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW RegCloseKey RegGetKeySecurity RegOpenKeyExA RegCreateKeyExW RegQueryValueExA RegEnumValueW RegSetKeySecurity RegNotifyChangeKeyValue RegSetValueExW RegQueryValueExW RegEnumKeyExW RegDeleteValueW

api-ms-win-security-base-l1-1-0

GetAce FreeSid SetSecurityDescriptorOwner IsValidSid ImpersonateLoggedOnUser AddAce GetTokenInformation InitializeSecurityDescriptor SetSecurityDescriptorDacl AdjustTokenPrivileges RevertToSelf InitializeAcl GetSecurityDescriptorDacl GetLengthSid AddAccessAllowedAceEx AllocateAndInitializeSid GetAclInformation CreateWellKnownSid

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW ConvertStringSidToSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-processthreads-l1-1-0

CreateProcessAsUserW SetThreadToken TlsFree SetThreadPriority OpenProcessToken GetStartupInfoW OpenThreadToken TlsSetValue TlsGetValue TlsAlloc GetThreadPriority

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW LookupPrivilegeValueW

api-ms-win-security-cryptoapi-l1-1-0

CryptReleaseContext CryptAcquireContextW CryptDeriveKey CryptDecrypt CryptDestroyKey CryptCreateHash CryptHashData CryptDestroyHash

api-ms-win-core-com-l1-1-0

CoCreateGuid CoSetProxyBlanket CLSIDFromProgID StringFromCLSID CLSIDFromString CoCreateInstance PropVariantClear

api-ms-win-security-provider-l1-1-0

SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW

api-ms-win-service-management-l1-1-0

OpenSCManagerW

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW

api-ms-win-core-interlocked-l1-1-0

InterlockedPopEntrySList InitializeSListHead InterlockedFlushSList QueryDepthSList InterlockedPushEntrySList

api-ms-win-core-processthreads-l1-1-1

GetThreadTimes

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW FreeLibraryAndExitThread GetModuleHandleA

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError

api-ms-win-core-synch-l1-2-0

SignalObjectAndWait

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW GetLogicalProcessorInformation

api-ms-win-core-threadpool-legacy-l1-1-0

ChangeTimerQueueTimer UnregisterWaitEx

api-ms-win-core-systemtopology-l1-1-0

GetNumaHighestNodeNumber

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask GetProcessAffinityMask

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject UnregisterWait

api-ms-win-core-handle-l1-1-0

DuplicateHandle

api-ms-win-core-synch-l1-1-0

WaitForMultipleObjectsEx ReleaseSemaphore InitializeCriticalSectionAndSpinCount

api-ms-win-core-memory-l1-1-0

VirtualAlloc VirtualFree VirtualProtect

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

rtworkq

RtwqPutWorkItem RtwqCreateAsyncResult

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsW

advapi32

QueryServiceStatus CreateServiceW SetServiceStatus ChangeServiceConfig2W DeleteService ControlService StartServiceW StartServiceCtrlDispatcherW QueryServiceStatusEx CloseServiceHandle OpenServiceW GetUserNameW

setupapi

SetupDiGetDevicePropertyW SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyA SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInterfaces SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW

ws2_32

WSAGetLastError WSARecv WSAStartup WSASetLastError shutdown WSASend WSACleanup

crypt32

CertFreeCertificateContext

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

api-ms-win-devices-config-l1-1-1

CM_Get_Parent CM_Get_Device_IDW

api-ms-win-core-string-l2-1-0

CharUpperW

api-ms-win-core-namedpipe-l1-1-0

ImpersonateNamedPipeClient

version

GetFileVersionInfoSizeW

cfgmgr32

CM_Get_DevNode_Status_Ex

api-ms-win-mm-misc-l1-1-0

mmioClose mmioAdvance mmioWrite mmioOpenW mmioDescend mmioCreateChunk mmioGetInfo mmioSeek mmioSetInfo mmioAscend

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

RT_CODE

Size

432KB

Virtual Size

432KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

83KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

110KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

280B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

584KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_fc6ad59fb6f39a7260603d042cbcc580_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

shlwapi

oleaut32

ole32

api-ms-win-power-setting-l1-1-0

powrprof

wtsapi32

shell32

userenv

api-ms-win-core-path-l1-1-0

propsys

netapi32

api-ms-win-core-registry-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

rtworkq

avrt

advapi32

setupapi

ws2_32

crypt32

api-ms-win-core-version-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-devices-config-l1-1-1

api-ms-win-core-string-l2-1-0

api-ms-win-core-namedpipe-l1-1-0

version

cfgmgr32

api-ms-win-mm-misc-l1-1-0

generic