2026-08-13_b08ff18f9c93ac646591366df063d51f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_b08ff18f9c93ac646591366df063d51f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 772KB
Sample260813-scelwssdra
SHA256 674335df898e2a1ea2d6356037bf47659498b2d1af87f74a9673fe34ffaeef8c
MD5 b08ff18f9c93ac646591366df063d51f
SHA1 ab86ee009e6e42503e888e9bd73f2e7b1f1e2726
SHA512 da5fd148ca32720c8bb96ab89440e160405572d12c8761b83a0bb98676e9c57c917baac68c9fc2820ceb9a264fd6d6aea8d01a5ebe389c7663f7a0566175c69c
SSDEEP 12288:218CwkmNpEcnL2N9LOmxUytzWsEPFQl1p760VMGUxet70SDkVJoMvPugxF1ssMK3:218CwkmscYrqhx7s/KJPpoFweTtjQ
TLSH
T1A5F47C3E76A901E8E1B7E17589AA5A06F6F1740A1235960F73F8076A1F37B705F2E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICOUS_EXE_References_VEEAM

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_b08ff18f9c93ac646591366df063d51f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-13_b08ff18f9c93ac646591366df063d51f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 772KB

2026-08-13_b08ff18f9c93ac646591366df063d51f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 81f9c372bbd459bc230038ebc2c0501e
SHA256 674335df898e2a1ea2d6356037bf47659498b2d1af87f74a9673fe34ffaeef8c
MD5 b08ff18f9c93ac646591366df063d51f
SHA1 ab86ee009e6e42503e888e9bd73f2e7b1f1e2726
SHA512 da5fd148ca32720c8bb96ab89440e160405572d12c8761b83a0bb98676e9c57c917baac68c9fc2820ceb9a264fd6d6aea8d01a5ebe389c7663f7a0566175c69c
SSDEEP 12288:218CwkmNpEcnL2N9LOmxUytzWsEPFQl1p760VMGUxet70SDkVJoMvPugxF1ssMK3:218CwkmscYrqhx7s/KJPpoFweTtjQ
TLSH
T1A5F47C3E76A901E8E1B7E17589AA5A06F6F1740A1235960F73F8076A1F37B705F2E310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing many references to VEEAM. Observed in ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

369136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptDestroyHash BCryptHashData BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCreateHash

ws2_32

gethostname

advapi32

ChangeServiceConfigW AdjustTokenPrivileges CloseServiceHandle RegCloseKey RegQueryValueExA GetUserNameA RegCreateKeyExW RegSetValueExW RegOpenKeyExW QueryServiceStatusEx OpenServiceW LookupPrivilegeValueW CheckTokenMembership EnumServicesStatusExW FreeSid OpenProcessToken EnumDependentServicesW ControlService AllocateAndInitializeSid OpenSCManagerW

user32

SetLayeredWindowAttributes SetWindowLongW GetAsyncKeyState ShowWindow SetWindowPos GetSystemMetrics GetWindowLongW SystemParametersInfoW

shell32

CommandLineToArgvW ShellExecuteW SHChangeNotify SHGetFolderPathW

kernel32

HeapReAlloc HeapSize GetTimeZoneInformation GetFileAttributesExW ReadConsoleW GetSystemTimeAsFileTime GetVolumeInformationW GetCurrentProcessId GetTickCount IsDebuggerPresent MultiByteToWideChar ReadFile GetFileSizeEx WriteFile VirtualAlloc SetEndOfFile CloseHandle SetFilePointerEx MoveFileExW GetLogicalDrives GetConsoleScreenBufferInfo SetPriorityClass SetConsoleTextAttribute GetCommandLineW GetCurrentProcess GetStdHandle ReleaseSemaphore SetConsoleMode GetConsoleCursorInfo DeviceIoControl GetModuleFileNameW SetThreadPriority CreateMutexW WaitForSingleObject IsValidCodePage CreateEventW GetConsoleMode GetLastError SetConsoleCursorInfo SetFileInformationByHandle FillConsoleOutputCharacterW GetDiskFreeSpaceExW GetCurrentThread DeleteFileW ResetEvent GetOverlappedResult WriteConsoleW LocalFree ExitProcess GlobalMemoryStatusEx CreateProcessW CreateSemaphoreW CopyFileW SetConsoleCursorPosition GetDriveTypeW SetConsoleScreenBufferSize SetCurrentConsoleFontEx GetTempPathW SetFileAttributesW GetConsoleWindow CreateProcessA lstrcmpiW SetConsoleTitleW GetExitCodeProcess FindFirstFileExW FindFirstVolumeW FindNextFileW GetQueuedCompletionStatus lstrlenA FindClose GetFileAttributesW PostQueuedCompletionStatus GetSystemInfo SetVolumeMountPointW FindVolumeClose GetVolumePathNamesForVolumeNameW InterlockedPushEntrySList FindNextVolumeW InitializeSListHead CreateIoCompletionPort InterlockedPopEntrySList HeapAlloc GetLogicalDriveStringsA GetProcAddress GetProcessHeap GetModuleHandleW WideCharToMultiByte GetComputerNameExA GetDiskFreeSpaceExA GetComputerNameA FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringEx DecodePointer EncodePointer SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable EnumSystemLocalesW GetUserDefaultLCID SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetACP CreateFileW GetOEMCP IsValidLocale GetLocaleInfoW WakeConditionVariable InitializeConditionVariable LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetConsoleOutputCP FlushFileBuffers GetFileType HeapFree GetCommandLineA FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx GetLocaleInfoEx GetEnvironmentStringsW GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId WaitForSingleObjectEx Sleep GetExitCodeThread

shlwapi

StrStrIW PathAppendW

winhttp

WinHttpSendRequest WinHttpConnect WinHttpReceiveResponse WinHttpOpen WinHttpCloseHandle WinHttpCrackUrl WinHttpOpenRequest

pdh

PdhOpenQueryW PdhAddCounterW PdhGetFormattedCounterValue PdhCollectQueryData

iphlpapi

GetIfTable GetAdaptersInfo

dwmapi

DwmSetWindowAttribute

mpr

WNetGetUniversalNameW

gdiplus

GdipCloneImage GdipDeleteBrush GdipAlloc GdipDisposeImage GdipSetSmoothingMode GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipGetImageEncoders GdipFree GdipDrawString GdipCreateFontFamilyFromName GdipGetImageGraphicsContext GdipFillRectangleI GdipGetImageEncodersSize GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipDeletePen GdipCreateBitmapFromScan0 GdipCreatePen1 GdipSetStringFormatAlign GdipSaveImageToFile GdipCloneBrush GdipDrawRectangleI GdipDeleteFontFamily GdipCreateStringFormat GdiplusShutdown GdiplusStartup GdipGetGenericFontFamilySansSerif

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader RtlUnwind

Name

.text

Size

572KB

Virtual Size

571KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

163KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_b08ff18f9c93ac646591366df063d51f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

bcrypt

ws2_32

advapi32

user32

shell32

kernel32

shlwapi

winhttp

pdh

iphlpapi

dwmapi

mpr

gdiplus

ntdll

generic