2026-08-08_a95a49b4ea805e4c8d42f9c4f360118d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_a95a49b4ea805e4c8d42f9c4f360118d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar
Size 1.5MB
Sample260808-nn7dtsem4w
SHA256 b2d1fb64ec577f8acab980f7efda791824046b5b63b5da3d6bdc733ff5fbd570
MD5 a95a49b4ea805e4c8d42f9c4f360118d
SHA1 5432951ff40525c6d8c48062e41e4f01bc7a24d5
SHA512 982d6e94be05137c1bd3332ffec20738568a96507723bb672b0086ee9e1549ed9a410875d26444ad8be0433ab0a2109a5d16a2d18f32e91499160305bb024a5a
SSDEEP 24576:mwnVpP+HrppxTuPu/Je7v9SXfc84Uj05a9jxWKjPs0QdqlH/nkYaB5sEREA+7437:hmjxD00QonkYmlREAfDv66mG
TLSH
T1F575BF1962E801FCE0B7E174C9968507E776785A13359AEF07E086671F676B0AE3F320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_a95a49b4ea805e4c8d42f9c4f360118d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-08-08_a95a49b4ea805e4c8d42f9c4f360118d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

.exe 1.5MB

2026-08-08_a95a49b4ea805e4c8d42f9c4f360118d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH fa5f1c80e29dbbb1235e2ea0a0ada346
SHA256 b2d1fb64ec577f8acab980f7efda791824046b5b63b5da3d6bdc733ff5fbd570
MD5 a95a49b4ea805e4c8d42f9c4f360118d
SHA1 5432951ff40525c6d8c48062e41e4f01bc7a24d5
SHA512 982d6e94be05137c1bd3332ffec20738568a96507723bb672b0086ee9e1549ed9a410875d26444ad8be0433ab0a2109a5d16a2d18f32e91499160305bb024a5a
SSDEEP 24576:mwnVpP+HrppxTuPu/Je7v9SXfc84Uj05a9jxWKjPs0QdqlH/nkYaB5sEREA+7437:hmjxD00QonkYmlREAfDv66mG
TLSH
T1F575BF1962E801FCE0B7E174C9968507E776785A13359AEF07E086671F676B0AE3F320
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

387360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\MY_PCNB\Forte_SVN\FMService_code\FMService_1_115_fix_HLKTest_crash\x64\Release\FMService64.pdb

rpcrt4

NdrServerCall2 RpcServerUseProtseqEpW RpcServerUnregisterIf NdrServerCallAll NdrClientCall3 RpcServerRegisterIf3 RpcServerListen RpcEpUnregister RpcBindingVectorFree RpcServerInqBindings RpcEpRegisterW

oleaut32

VariantClear SysAllocString SysFreeString

kernel32

GetSystemDirectoryW FindFirstFileW FindClose CreateFileW GetFileSize ReadFile FlsAlloc Sleep DeleteFileW GetCurrentProcess FlsGetValue FlsSetValue LocalAlloc FlsFree GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW LocalFree IsValidLocale HeapAlloc GetProcessHeap GlobalFree OutputDebugStringW GetLastError GetUserDefaultLCID HeapFree EnumSystemLocalesW GlobalAlloc IsValidCodePage GetACP ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileSizeEx FormatMessageW GetFileType GetCommandLineW GetCommandLineA GetStdHandle ExitProcess GetProcessId LoadLibraryExW CreateDirectoryW GetModuleFileNameA CreateSemaphoreExW SetLastError ReleaseSemaphore GetModuleHandleExW InitializeCriticalSectionEx WaitForSingleObject GetCurrentThreadId ReleaseMutex HeapSize WaitForSingleObjectEx OpenSemaphoreW HeapReAlloc RaiseException DecodePointer GetProcAddress FreeLibrary CreateMutexExW GetCurrentProcessId GetModuleHandleW CopyFileW DebugBreak IsDebuggerPresent TlsFree SetEvent InitializeSRWLock GetOEMCP TlsSetValue WTSGetActiveConsoleSessionId K32GetModuleBaseNameW K32EnumProcessModules OpenProcess K32EnumProcesses GetEnvironmentStringsW GetTempPathW WaitForMultipleObjects WriteFile CreateProcessW CreateFileMappingW MapViewOfFile CreateThread CreateThreadpoolWork SubmitThreadpoolWork RtlUnwind TlsGetValue LeaveCriticalSection TlsAlloc GetLocalTime RtlPcToFileHeader EnterCriticalSection GetCurrentDirectoryW RtlUnwindEx GetCPInfo CompareStringEx GetStringTypeW GetLocaleInfoEx LCMapStringEx EncodePointer GetFileInformationByHandleEx MoveFileExW FreeEnvironmentStringsW CloseHandle AreFileApisANSI DeleteCriticalSection GetModuleFileNameW CreateEventW InitializeCriticalSection SetEnvironmentVariableW AcquireSRWLockExclusive ReleaseSRWLockExclusive SetStdHandle GetTimeZoneInformation WriteConsoleW SetFilePointerEx SetFileInformationByHandle SetEndOfFile GetDateFormatW GetFileAttributesExW FindNextFileW FindFirstFileExW FormatMessageA MultiByteToWideChar WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW ResetEvent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount

shlwapi

StrStrW PathFileExistsW ord176 StrStrIW

ole32

PropVariantClear CoUninitialize CoCreateInstance StringFromGUID2 CoInitializeEx CoInitialize

advapi32

RegNotifyChangeKeyValue NotifyServiceStatusChangeW DeleteService ControlService CreateServiceW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW ReportEventW DeregisterEventSource RegisterEventSourceW QueryServiceStatus OpenServiceW OpenSCManagerW CreateProcessAsUserW GetTokenInformation DuplicateTokenEx CloseServiceHandle RegSetValueExW RegDeleteValueW SetSecurityDescriptorDacl SetEntriesInAclW GetSecurityDescriptorDacl RegGetKeySecurity FreeSid RegSetKeySecurity SetSecurityDescriptorOwner RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW AllocateAndInitializeSid InitializeSecurityDescriptor AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCreateKeyExW

user32

CharUpperW RegisterPowerSettingNotification UnregisterPowerSettingNotification GetSystemMetrics

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSQuerySessionInformationW

propsys

InitPropVariantFromCLSID

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

Name

.text

Size

753KB

Virtual Size

753KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

197KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_a95a49b4ea805e4c8d42f9c4f360118d_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

rpcrt4

oleaut32

kernel32

shlwapi

ole32

advapi32

user32

wtsapi32

propsys

version

api-ms-win-security-base-l1-2-2

generic