2026-08-10_86a69d01e3f749d559b243dd3c2bc908_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_86a69d01e3f749d559b243dd3c2bc908_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar
Size 385KB
Sample260810-e5dy6sbj4z
SHA256 f1fee86ee3107f2a1d35f2e013fc7243acd908ac160c811441c6f88342aa85da
MD5 86a69d01e3f749d559b243dd3c2bc908
SHA1 a693bdcb4ba2e7711468e1ddefb0338794f80a6e
SHA512 8bc7a43bbc41262aca5ba0bb2127bd1581eeaf5c3390710782b81610a2d41ad7000f4a6ed0be5c4fe2fc6a3e7b070a45b203972d7e3fce2a8b0969eddd375efa
SSDEEP 6144:fT7XbYQGfc7vOObY0qgB9IjGuBdEgSqGS/1UtZexl3nXYSTcYSd0+1Q1An:rL0rcbOObYY9IjxdZlAZextnXNchdfn
TLSH
T162849E41F6A404F6D5BB9178C895890AE7727C6907B0DBCF23A496662F333D01E3E7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-10_86a69d01e3f749d559b243dd3c2bc908_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

.exe 385KB

2026-08-10_86a69d01e3f749d559b243dd3c2bc908_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH fd2738f6bcdcdc8abb82c535da92d749
SHA256 f1fee86ee3107f2a1d35f2e013fc7243acd908ac160c811441c6f88342aa85da
MD5 86a69d01e3f749d559b243dd3c2bc908
SHA1 a693bdcb4ba2e7711468e1ddefb0338794f80a6e
SHA512 8bc7a43bbc41262aca5ba0bb2127bd1581eeaf5c3390710782b81610a2d41ad7000f4a6ed0be5c4fe2fc6a3e7b070a45b203972d7e3fce2a8b0969eddd375efa
SSDEEP 6144:fT7XbYQGfc7vOObY0qgB9IjGuBdEgSqGS/1UtZexl3nXYSTcYSd0+1Q1An:rL0rcbOObYY9IjxdZlAZextnXNchdfn
TLSH
T162849E41F6A404F6D5BB9178C895890AE7727C6907B0DBCF23A496662F333D01E3E7A1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

5f:1d:1b:10:9f:c1:ee:d1:39:1d:5e:d8:2d:81:fa:7b:6f:83:dc:da

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=110111-3320241,CN=NEXON Korea Corporation,O=NEXON Korea Corporation,L=Seongnam-si,ST=Gyeonggi-do,C=KR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130b53656f6e676e616d2d7369,1.3.6.1.4.1.311.60.2.1.2=#130b4779656f6e6767692d646f,1.3.6.1.4.1.311.60.2.1.3=#13024b52

Chains

Aug 5, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

d5:58:5e:8e:a1:50:f4:6b:9e:0e:78:1f:55:5a:ce:d1:be:ed:4b:14:da:2b:3f:24:1f:ab:0f:06:8a:9b:44:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

Chains

Aug 5, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

Serial Number

05:0d:03:da:fe:12:57:7c:fc:f9:e2:75:2c:e9:23:83

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 18, 2025 - Feb 13, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

91148

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Gitlab-Runner\builds\SeBBojk4N\0\platform\ngm\ngm\Output\x64\Release\NGM64.pdb

kernel32

DeleteCriticalSection DecodePointer InitializeCriticalSectionEx FormatMessageW FreeLibrary CloseHandle WaitForSingleObject GetModuleFileNameW FindClose FindNextFileW DeleteFileW FindFirstFileW GetProcAddress LoadLibraryW MultiByteToWideChar WideCharToMultiByte LocalFree GetFileAttributesW GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy FindResourceExW FindResourceW LoadResource WriteConsoleW ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetStdHandle ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError LockResource SizeofResource GetLastError Sleep GetCurrentProcess EnterCriticalSection LeaveCriticalSection CreateFileW ReadFile WriteFile MoveFileW TerminateProcess CreateDirectoryW MoveFileExW SetFileAttributesW SetFilePointerEx GetFileSizeEx LoadLibraryExW GetModuleHandleExW GetCurrentThreadId GetCommandLineW CreateMutexW ReleaseMutex LocalAlloc IsDebuggerPresent OutputDebugStringW RaiseException GetStringTypeW EncodePointer GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetEndOfFile

user32

GetDesktopWindow MessageBoxW GetForegroundWindow SetForegroundWindow

advapi32

DeleteService OpenServiceW CreateServiceW RegCloseKey RegOpenKeyExW RegQueryValueExW OpenSCManagerW CloseServiceHandle EqualSid GetAce GetAclInformation FreeSid AllocateAndInitializeSid GetNamedSecurityInfoW SetNamedSecurityInfoW GetSecurityDescriptorDacl ConvertStringSecurityDescriptorToSecurityDescriptorW ChangeServiceConfigW QueryServiceConfigW ControlService StartServiceW SetSecurityDescriptorSacl GetSecurityDescriptorSacl SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW QueryServiceStatus

shell32

SHGetSpecialFolderPathW ShellExecuteExW

shlwapi

PathFileExistsW PathFindFileNameW PathCombineW PathRemoveFileSpecW

ws2_32

WSARecv WSACreateEvent WSASend WSAEventSelect WSACleanup WSAResetEvent WSAEnumNetworkEvents WSAConnect WSAGetLastError WSASocketW WSACloseEvent closesocket WSAStartup GetAddrInfoW FreeAddrInfoW WSAGetOverlappedResult WSASetEvent WSASetLastError

wininet

HttpQueryInfoW InternetQueryDataAvailable HttpSendRequestW HttpOpenRequestW InternetGetLastResponseInfoW InternetReadFile InternetConnectW InternetCloseHandle InternetSetOptionW InternetOpenW InternetQueryOptionW

ole32

CoUninitialize CoInitialize CoCreateInstance

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_86a69d01e3f749d559b243dd3c2bc908_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

kernel32

user32

advapi32

shell32

shlwapi

ws2_32

wininet

ole32

generic