2026-08-11_0a7ce1cf6446e166a406f6442446c877_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_0a7ce1cf6446e166a406f6442446c877_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar
Size 1.6MB
Sample260811-z61vjsdm21
SHA256 ca96796c77300076d2ad164163b724714b69764bbc40502672103f61d2eaa7f4
MD5 0a7ce1cf6446e166a406f6442446c877
SHA1 7099f4f1568f48e67f1cbbd57b6c7540f246fc88
SHA512 a63485baec34b0f6e8b0d5c5a834618ab615372cedd25bc4a70d7b2a1676c83e49767084db8af868c5810a0063c3ba729bbe703a54e0d17901c24dc5d897e9d6
SSDEEP 24576:5Jm5QGifgTyKueactfnvOHbf8sR0uGLS4mYrqI1X3Tx0d+wtYcrUXlFWsqjnhMgG:grTdAU7aDmg27RnWGj
TLSH
T10975AF1662ED01FCF0BBD234CAA64507E676789613359ADF03D0856A1F67AB09E3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_0a7ce1cf6446e166a406f6442446c877_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-08-11_0a7ce1cf6446e166a406f6442446c877_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

.exe 1.6MB

2026-08-11_0a7ce1cf6446e166a406f6442446c877_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 71ec3c87eeb51623cc99156d0d5fb5e4
SHA256 ca96796c77300076d2ad164163b724714b69764bbc40502672103f61d2eaa7f4
MD5 0a7ce1cf6446e166a406f6442446c877
SHA1 7099f4f1568f48e67f1cbbd57b6c7540f246fc88
SHA512 a63485baec34b0f6e8b0d5c5a834618ab615372cedd25bc4a70d7b2a1676c83e49767084db8af868c5810a0063c3ba729bbe703a54e0d17901c24dc5d897e9d6
SSDEEP 24576:5Jm5QGifgTyKueactfnvOHbf8sR0uGLS4mYrqI1X3Tx0d+wtYcrUXlFWsqjnhMgG:grTdAU7aDmg27RnWGj
TLSH
T10975AF1662ED01FCF0BBD234CAA64507E676789613359ADF03D0856A1F67AB09E3F321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

422176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\MY_PCNB\Forte_SVN\FMService_all\FMService\x64\Release\FMService64.pdb

rpcrt4

NdrClientCall3 RpcBindingVectorFree RpcServerUseProtseqEpW RpcServerUnregisterIf RpcServerRegisterIf3 NdrServerCallAll NdrServerCall2 RpcServerListen RpcEpUnregister RpcEpRegisterW RpcServerInqBindings

oleaut32

VariantClear SysFreeString SysAllocString

kernel32

FindFirstFileW FindClose CreateFileW GetFileSize ReadFile WTSGetActiveConsoleSessionId FlsAlloc GetLastError GetSystemDirectoryW FlsGetValue Sleep DeleteFileW FlsSetValue GetCurrentProcess FlsFree LocalAlloc VirtualProtect GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW LocalFree GlobalFree HeapAlloc GetProcessHeap OutputDebugStringW IsValidLocale GetUserDefaultLCID HeapFree EnumSystemLocalesW GlobalAlloc IsValidCodePage GetProcessId ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileSizeEx FormatMessageW GetFileType GetCommandLineW GetACP GetStdHandle ExitProcess GetDateFormatW QueryPerformanceFrequency CreateDirectoryW GetModuleFileNameA CreateSemaphoreExW SetLastError ReleaseSemaphore GetModuleHandleExW LoadLibraryExW InitializeCriticalSectionEx WaitForSingleObject GetCurrentThreadId ReleaseMutex HeapSize FreeLibrary WaitForSingleObjectEx OpenSemaphoreW HeapReAlloc RaiseException DecodePointer GetProcAddress TlsFree CreateMutexExW GetCurrentProcessId GetModuleHandleW CopyFileW DebugBreak IsDebuggerPresent TlsSetValue SetEvent InitializeSRWLock K32GetModuleBaseNameW K32EnumProcessModules OpenProcess K32EnumProcesses GetOEMCP GetEnvironmentStringsW GetTempPathW WaitForMultipleObjects TlsGetValue TlsAlloc LeaveCriticalSection WriteFile CreateProcessW CreateFileMappingW MapViewOfFile CreateThreadpoolWork SubmitThreadpoolWork CreateThread RtlUnwind GetLocalTime EnterCriticalSection RtlPcToFileHeader FreeEnvironmentStringsW GetCurrentDirectoryW RtlUnwindEx GetCPInfo CompareStringEx GetStringTypeW GetLocaleInfoEx LCMapStringEx EncodePointer GetFileInformationByHandleEx MoveFileExW AreFileApisANSI SetFilePointerEx SetFileInformationByHandle CloseHandle DeleteCriticalSection SetEndOfFile CreateEventW GetModuleFileNameW InitializeCriticalSection SetEnvironmentVariableW SetStdHandle GetTimeZoneInformation WriteConsoleW GetCommandLineA GetFileAttributesExW FindNextFileW CreateMutexW FindFirstFileExW FormatMessageA InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW ResetEvent InitializeCriticalSectionAndSpinCount MultiByteToWideChar WideCharToMultiByte IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry

shlwapi

StrStrW PathFileExistsW StrStrIW ord176

ole32

CLSIDFromString CoUninitialize CoTaskMemAlloc PropVariantClear CoTaskMemFree CoCreateInstance StringFromGUID2 CoInitialize CoInitializeEx

setupapi

CM_Get_Device_IDW CM_Get_Parent SetupDiGetDeviceInterfaceDetailW SetupDiCreateDeviceInterfaceW SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdW SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList

advapi32

DeleteService ControlService CreateServiceW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW ReportEventW DeregisterEventSource RegisterEventSourceW RegNotifyChangeKeyValue QueryServiceStatus OpenServiceW OpenSCManagerW CreateProcessAsUserW GetTokenInformation DuplicateTokenEx CloseServiceHandle RegCreateKeyExW RegDeleteValueW SetSecurityDescriptorDacl SetEntriesInAclW GetSecurityDescriptorDacl RegGetKeySecurity FreeSid RegSetKeySecurity SetSecurityDescriptorOwner AllocateAndInitializeSid RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW InitializeSecurityDescriptor AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegSetValueExW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken

user32

UnregisterPowerSettingNotification RegisterPowerSettingNotification CharUpperW GetSystemMetrics

shell32

SHGetKnownFolderPath

propsys

InitPropVariantFromCLSID

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

Name

.text

Size

789KB

Virtual Size

788KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

236KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_0a7ce1cf6446e166a406f6442446c877_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

rpcrt4

oleaut32

kernel32

shlwapi

ole32

setupapi

advapi32

wtsapi32

user32

shell32

propsys

version

api-ms-win-security-base-l1-2-2

generic