2026-08-09_4910ebfaf7b9779a44d1fb267c2c0597_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_4910ebfaf7b9779a44d1fb267c2c0597_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.4MB
Sample260809-veka9sam61
SHA256 1cdc4ca634f84f89f3b25135b597692d48ebd13a8abbde20056c0d0b5b5e1c21
MD5 4910ebfaf7b9779a44d1fb267c2c0597
SHA1 e4b8f825b82150fbf3d7d2cb58266d214fe2716b
SHA512 2104c7823d66bdec540214454ff3d7ec6ebaaea301e18eb10ef97abfc9c7e54eed31598d7ca1e6ced477510eddc1130ac18ba5cfd4f43631fdf45e24197b2ea8
SSDEEP 24576:DkfbWXcctDL0yOf6UbQCaNIfm7z94D1X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mb8csPa6+Q56fmQXLNiXicJFFRGNzj3
TLSH
T15565BE16ABEC01E8E0B7A27999B25905FA727C55073096CF1390926E2F77FD08F79321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_4910ebfaf7b9779a44d1fb267c2c0597_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-09_4910ebfaf7b9779a44d1fb267c2c0597_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.4MB

2026-08-09_4910ebfaf7b9779a44d1fb267c2c0597_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 3c57e34a74af76ff5ab0fa244280f643
SHA256 1cdc4ca634f84f89f3b25135b597692d48ebd13a8abbde20056c0d0b5b5e1c21
MD5 4910ebfaf7b9779a44d1fb267c2c0597
SHA1 e4b8f825b82150fbf3d7d2cb58266d214fe2716b
SHA512 2104c7823d66bdec540214454ff3d7ec6ebaaea301e18eb10ef97abfc9c7e54eed31598d7ca1e6ced477510eddc1130ac18ba5cfd4f43631fdf45e24197b2ea8
SSDEEP 24576:DkfbWXcctDL0yOf6UbQCaNIfm7z94D1X/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:mb8csPa6+Q56fmQXLNiXicJFFRGNzj3
TLSH
T15565BE16ABEC01E8E0B7A27999B25905FA727C55073096CF1390926E2F77FD08F79321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

336640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\__w\1\s\cmake\obj\x64-Release\wcd\Source\Service\src\MsSense.pdb

kernel32

CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection CreateFileW FindFirstVolumeW FindNextVolumeW FindVolumeClose GetDriveTypeW GetLogicalDrives GetVolumeInformationW QueryDosDeviceW GetVolumeNameForVolumeMountPointW GetVolumePathNamesForVolumeNameW DeviceIoControl GlobalAlloc GlobalFree MultiByteToWideChar WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter CompareFileTime CreateThreadpoolTimer GetSystemTimeAsFileTime GetProductInfo GetVersionExW Sleep AcquireSRWLockShared DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers AcquireSRWLockExclusive RemoveDirectoryW SetFileAttributesW SetFilePointerEx WriteFile ReleaseSRWLockShared ReleaseSRWLockExclusive VerSetConditionMask MoveFileExW FindFirstFileExW EnterCriticalSection GetOEMCP GetWindowsDirectoryW GetComputerNameExW LoadLibraryW FreeLibrary TerminateProcess GetCurrentProcess InitOnceComplete InitOnceBeginInitialize WideCharToMultiByte FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetACP IsValidCodePage GetModuleFileNameA CompareStringW GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW DecodePointer HeapReAlloc HeapSize GetCurrentThreadId GetCurrentProcessId CreateSemaphoreExW CreateMutexExW LCMapStringW OpenSemaphoreW WaitForSingleObjectEx FlsFree WaitForSingleObject ReleaseMutex ReleaseSemaphore FlsSetValue FlsGetValue FlsAlloc GetFileType ExpandEnvironmentStringsW GetCommandLineW GetCommandLineA GetStdHandle ExitProcess LoadLibraryExW TlsFree TlsSetValue VerifyVersionInfoW TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount InterlockedPushEntrySList RtlUnwindEx GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind GetProcessHeap HeapFree HeapAlloc SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak GetFileAttributesW IsDebuggerPresent RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetModuleHandleExA RtlPcToFileHeader GetStringTypeW WakeAllConditionVariable SleepConditionVariableSRW EncodePointer CompareStringEx GetCPInfo LCMapStringEx

advapi32

RegGetValueW RegDeleteKeyValueW RegOpenKeyExW RegCreateKeyExW OpenSCManagerW CloseServiceHandle RegSetValueExW StartServiceCtrlDispatcherW EventRegister EventUnregister EventSetInformation EventWriteTransfer GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorDacl LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken SetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorW GetSecurityDescriptorSacl DestroyPrivateObjectSecurity ChangeServiceConfigW OpenServiceW StartServiceW RegCloseKey QueryServiceConfigW ControlService

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

api-ms-win-core-featurestaging-l1-1-0

GetFeatureEnabledState RecordFeatureUsage SubscribeFeatureStateChangeNotification RecordFeatureError UnsubscribeFeatureStateChangeNotification

api-ms-win-core-featurestaging-l1-1-1

GetFeatureVariant

api-ms-win-core-path-l1-1-0

PathCchCombine

userenv

GetAllUsersProfileDirectoryW

ws2_32

InetNtopW

iphlpapi

GetUnicastIpAddressEntry GetIfEntry2 GetUnicastIpAddressTable FreeMibTable

setupapi

SetupDiGetDeviceRegistryPropertyW SetupOpenInfFileW SetupInstallFromInfSectionW SetupInstallServicesFromInfSectionW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW SetupDiGetDevicePropertyW SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyHash

ntdll

RtlInitUnicodeString

Name

.text

Size

545KB

Virtual Size

544KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

205KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_4910ebfaf7b9779a44d1fb267c2c0597_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

advapi32

version

api-ms-win-core-featurestaging-l1-1-0

api-ms-win-core-featurestaging-l1-1-1

api-ms-win-core-path-l1-1-0

userenv

ws2_32

iphlpapi

setupapi

bcrypt

ntdll

generic