2026-08-12_f0e050e4469d0e919d793eae405500b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_f0e050e4469d0e919d793eae405500b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.2MB
Sample260812-pywwhsgn5x
SHA256 b01a8fd86f234b7105e67ec056b92d812f5e62a80edcf46c37bb57ccf6f89b82
MD5 f0e050e4469d0e919d793eae405500b3
SHA1 4326271b59ab4f2d63af1fb2aa88f9835b33eaf3
SHA512 d2e310a2c455267b6dc926587e79bf649e4ca1a04ab106db519c820d0a23e81a06a83fed8dc3854a4444a8cae01b3bf9e33cc2289dea29597229190f1ad5cefc
SSDEEP 24576:4Kk9p+L8zGgKdz3ru0HsqjnhMgeiCl7G0nehbGZpbD:4Lp+VgK1r5Dmg27RnWGj
TLSH
T18055D085A69C03F5D47A8535C9428779E071BC2547A28BCB82B43BAE0F7B5E44F3DB60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_f0e050e4469d0e919d793eae405500b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-12_f0e050e4469d0e919d793eae405500b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.2MB

2026-08-12_f0e050e4469d0e919d793eae405500b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 2f71670ea4e911bae3c8f03da5dd22e4
SHA256 b01a8fd86f234b7105e67ec056b92d812f5e62a80edcf46c37bb57ccf6f89b82
MD5 f0e050e4469d0e919d793eae405500b3
SHA1 4326271b59ab4f2d63af1fb2aa88f9835b33eaf3
SHA512 d2e310a2c455267b6dc926587e79bf649e4ca1a04ab106db519c820d0a23e81a06a83fed8dc3854a4444a8cae01b3bf9e33cc2289dea29597229190f1ad5cefc
SSDEEP 24576:4Kk9p+L8zGgKdz3ru0HsqjnhMgeiCl7G0nehbGZpbD:4Lp+VgK1r5Dmg27RnWGj
TLSH
T18055D085A69C03F5D47A8535C9428779E071BC2547A28BCB82B43BAE0F7B5E44F3DB60
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

167808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qb\workspace\21461\source\output\dump64\gfxui\EventManager\igfxEMN\Release\igfxEMN.pdb

kernel32

GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalUnlock GlobalLock GlobalHandle GlobalFree MulDiv lstrcmpW lstrcmpiW MultiByteToWideChar WideCharToMultiByte DeleteFileW FindClose FindFirstFileW FindNextFileW GetExitCodeThread GetTickCount ExpandEnvironmentStringsW SetFileAttributesW GetSystemDirectoryW CreateDirectoryW OpenEventW GetCurrentProcessId ProcessIdToSessionId GetFileAttributesW CreateProcessW LoadLibraryW WTSGetActiveConsoleSessionId GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetSystemDefaultLangID WriteConsoleW SetEndOfFile CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindFirstFileExW FlushFileBuffers GetOEMCP GetACP IsValidCodePage GetFileSizeEx GetConsoleOutputCP SetFilePointerEx HeapSize GetConsoleMode GetTimeZoneInformation GetFileType FreeLibrary GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleHandleExW ExitProcess WriteFile GetStdHandle ReadFile VirtualQuery VirtualProtect GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwindEx RtlPcToFileHeader GetCPInfo LCMapStringEx GetStringTypeW LocalFree GetStartupInfoW GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent FindResourceExW HeapFree HeapReAlloc HeapAlloc HeapDestroy SetLastError RaiseException CloseHandle GetCommandLineW DeleteCriticalSection InitializeCriticalSectionEx GetCurrentThreadId CreateThread Sleep CreateEventW CreateMutexW WaitForSingleObject SetEvent LeaveCriticalSection EnterCriticalSection EnumSystemLocalesW GetProcessHeap DecodePointer GetLastError ReadConsoleW RtlUnwind

user32

GetWindowRect SetWindowContextHelpId MessageBoxW GetCursorPos SetForegroundWindow LoadImageW MapDialogRect SetMenuDefaultItem TrackPopupMenuEx UnregisterClassW RegisterWindowMessageW GetMessageW TranslateMessage DispatchMessageW SetWindowPos MoveWindow CreateDialogIndirectParamW GetDlgItem CharUpperW DestroyWindow IsChild IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW PostThreadMessageW LoadIconW SendMessageW CharNextW SetFocus GetFocus SetCapture ReleaseCapture CreateAcceleratorTableW DestroyAcceleratorTable GetDC ReleaseDC BeginPaint EndPaint InvalidateRect InvalidateRgn RedrawWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW GetClientRect InsertMenuW GetSubMenu GetSystemMetrics KillTimer SetTimer MapVirtualKeyExW GetKeyNameTextW SendDlgItemMessageW EndDialog CreateDialogParamW IsWindowVisible ShowWindow PostQuitMessage UnregisterDeviceNotification RegisterDeviceNotificationW UnregisterHotKey RegisterHotKey GetKeyboardLayout GetKeyboardLayoutList ActivateKeyboardLayout LoadKeyboardLayoutW PeekMessageW FindWindowW DestroyMenu CreatePopupMenu PostMessageW LoadCursorW GetWindow GetClassNameW GetParent GetDesktopWindow SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW GetWindowLongW FillRect GetSysColor ScreenToClient ClientToScreen

gdi32

SelectObject GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap BitBlt GetObjectW

advapi32

RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegSetValueExW RegQueryValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegDeleteKeyW

ole32

CLSIDFromString OleLockRunning OleRun OleUninitialize OleInitialize CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CLSIDFromProgID CoInitializeEx CoCreateInstance CoReleaseServerProcess CoAddRefServerProcess CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoGetClassObject CoUninitialize CreateStreamOnHGlobal

oleaut32

SysAllocStringByteLen SysStringByteLen OleCreateFontIndirect UnRegisterTypeLi RegisterTypeLi LoadRegTypeLi VarUI4FromStr VariantClear GetErrorInfo LoadTypeLi VariantInit SysStringLen SysAllocStringLen SysAllocString SysFreeString

setupapi

SetupDiOpenDevRegKey SetupDiCreateDeviceInfoList SetupDiOpenDeviceInfoW SetupDiGetDevicePropertyW SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

shell32

SHCreateItemFromParsingName Shell_NotifyIconW

shlwapi

StrStrW

bcrypt

BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptDestroyKey BCryptDecrypt BCryptEncrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider BCryptCreateHash

version

GetFileVersionInfoExW VerQueryValueW GetFileVersionInfoSizeExW

Name

.text

Size

382KB

Virtual Size

381KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

148KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_f0e050e4469d0e919d793eae405500b3_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

gdi32

advapi32

ole32

oleaut32

setupapi

wtsapi32

shell32

shlwapi

bcrypt

version

generic