stealc | 2026-08-11_51c71ad74e415f0fbba341788261b01a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_51c71ad74e415f0fbba341788261b01a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 15.4MB
Sample260811-htm99adb29
SHA256 af453dbfdf22ceb86cf1b62561dc57927fdcb21b9673a9b580bda8fbf16c2bb9
MD5 51c71ad74e415f0fbba341788261b01a
SHA1 a8a5c9664b3f1874233c4da354849508707d439a
SHA512 873bc8eaf20a57c1eb1c88c59fe906bf95fcdbc029cd6ec7600367d8806e17ad4e5810190056791951c7fc363fe66d08447c45218c3d6317237dc4e108f2fbe4
SSDEEP 196608:RelZiBc37CQpyXYf9y75CS3vg8L8IZT+8sIM1Ofe6lageFKiudkttjI+FHeCnbwT:0THZVO5D3vpLzNsuG6NeFKiUktNZFMm
TLSH
T116F613666BC521B8F0A3B239B5870247E381FD9941AE8F4E27C17C037B71DBA690E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

tr1pernn stealer stealc

Malware Config

Extracted

Family

stealc

Botnet

tr1pernn

http://178.16.54.175

Attributes

url_path
/e9762ff07e084dbb.php

rc4.traffic_key

rc4.C2

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 2 1 IoCs

resource	yara_rule
sample	family_stealc_v2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_51c71ad74e415f0fbba341788261b01a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-11_51c71ad74e415f0fbba341788261b01a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 15.4MB

2026-08-11_51c71ad74e415f0fbba341788261b01a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH e984c9552167c47b13f80743eea201e4
SHA256 af453dbfdf22ceb86cf1b62561dc57927fdcb21b9673a9b580bda8fbf16c2bb9
MD5 51c71ad74e415f0fbba341788261b01a
SHA1 a8a5c9664b3f1874233c4da354849508707d439a
SHA512 873bc8eaf20a57c1eb1c88c59fe906bf95fcdbc029cd6ec7600367d8806e17ad4e5810190056791951c7fc363fe66d08447c45218c3d6317237dc4e108f2fbe4
SSDEEP 196608:RelZiBc37CQpyXYf9y75CS3vg8L8IZT+8sIM1Ofe6lageFKiudkttjI+FHeCnbwT:0THZVO5D3vpLzNsuG6NeFKiUktNZFMm
TLSH
T116F613666BC521B8F0A3B239B5870247E381FD9941AE8F4E27C17C037B71DBA690E751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Stealc stealer Version 2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8445639

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleFileNameA LoadLibraryA GetProcAddress GetCurrentProcess CreateFileW QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId MultiByteToWideChar GetStringTypeW GetLocaleInfoEx WideCharToMultiByte InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess WriteFile HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize CloseHandle HeapAlloc HeapFree ExitProcess LoadLibraryA GetModuleHandleA GetProcAddress

Name

.text

Size

444KB

Virtual Size

448KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

177KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.7,

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fVO

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ko7

Size

9.5MB

Virtual Size

9.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

167KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-08-11_51c71ad74e415f0fbba341788261b01a_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

generic