2026-08-13_7fbc1a1ca9f3b66154143f5adeb943ce_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_7fbc1a1ca9f3b66154143f5adeb943ce_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.6MB
Sample260813-wsbfyswang
SHA256 8ea71ab05fbb1ec3b881c060af0542f756cc2d687805dbfd7da7e0838d13bf7b
MD5 7fbc1a1ca9f3b66154143f5adeb943ce
SHA1 424631adc4f160af684f461ede03c915ab592799
SHA512 64b34e3ea14074a6be17baa59f6bc9d9cc6fe62bc7363aae7114011f791e4a30a7ad0f533d2c611a763d5e155a7bfa2675060d237a636f76241d4a7addf11d03
SSDEEP 24576:VTqotdzG8udw0sMjt2rR8FfBhRJUEbDk1ulUM:VTntdzG8SwjMjt2r4PRSEk1ul
TLSH
T1457539D2D2CC3378D3659CB485B1091F933B7C4E062286D747E278E64B3A5AA8BFD611
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_7fbc1a1ca9f3b66154143f5adeb943ce_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-13_7fbc1a1ca9f3b66154143f5adeb943ce_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.6MB

2026-08-13_7fbc1a1ca9f3b66154143f5adeb943ce_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH abe40111824c25f322c5522343522c53
SHA256 8ea71ab05fbb1ec3b881c060af0542f756cc2d687805dbfd7da7e0838d13bf7b
MD5 7fbc1a1ca9f3b66154143f5adeb943ce
SHA1 424631adc4f160af684f461ede03c915ab592799
SHA512 64b34e3ea14074a6be17baa59f6bc9d9cc6fe62bc7363aae7114011f791e4a30a7ad0f533d2c611a763d5e155a7bfa2675060d237a636f76241d4a7addf11d03
SSDEEP 24576:VTqotdzG8udw0sMjt2rR8FfBhRJUEbDk1ulUM:VTntdzG8SwjMjt2r4PRSEk1ul
TLSH
T1457539D2D2CC3378D3659CB485B1091F933B7C4E062286D747E278E64B3A5AA8BFD611
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

223232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\home\jenkins\agent\workspace\ITS_LEN0100_hotfix_2.1.52.x\pdb\release\LITSSvc.pdb

wtsapi32

WTSQueryUserToken WTSQuerySessionInformationW

userenv

CreateEnvironmentBlock

advapi32

RegEnumKeyW FreeSid LookupAccountSidW AllocateAndInitializeSid RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegCloseKey RegCreateKeyExW RegSetValueExW RegNotifyChangeKeyValue RegDeleteValueW CreateWellKnownSid SetEntriesInAclW InitializeSecurityDescriptor SetSecurityDescriptorDacl OpenSCManagerW OpenServiceW ControlService CloseServiceHandle RegEnumValueW ImpersonateLoggedOnUser RevertToSelf CreateProcessAsUserW QueryServiceConfigW ChangeServiceConfigW StartServiceW RegDeleteKeyExW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW SetServiceStatus RegOpenCurrentUser RegGetValueW

powrprof

PowerRegisterForEffectivePowerModeNotifications PowerUnregisterFromEffectivePowerModeNotifications

pdh

PdhOpenQueryW PdhRemoveCounter PdhGetFormattedCounterValue PdhCloseQuery PdhCollectQueryData PdhAddCounterW

dxgi

CreateDXGIFactory

wevtapi

EvtClose EvtCreateRenderContext EvtRender EvtSubscribe

kernel32

GetDateFormatW GetTimeFormatW CompareStringW VirtualProtect FlsFree FlsSetValue WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx CloseHandle CreateFileW Sleep DeviceIoControl GetLastError InitializeCriticalSectionEx DeleteCriticalSection DecodePointer WaitForSingleObject HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap CreateEventW SetPriorityClass GetCurrentProcess ResetEvent LoadLibraryExW GetProcAddress FreeLibrary LocalFree lstrcmpiW CreateMutexW ReleaseMutex LocalAlloc LoadResource LockResource SizeofResource FindResourceW DeleteFileW FindFirstFileW WriteFile FindClose FindNextFileW RemoveDirectoryW Wow64DisableWow64FsRedirection CreateProcessW Wow64RevertWow64FsRedirection QueryFullProcessImageNameW CreateThread SetEvent WaitForMultipleObjects K32EnumProcesses OpenProcess OOBEComplete TerminateThread CreateToolhelp32Snapshot Process32FirstW Process32NextW ExitThread RegisterWaitUntilOOBECompleted GetExitCodeProcess GetSystemPowerStatus WTSGetActiveConsoleSessionId FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType LCMapStringW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlPcToFileHeader RtlUnwindEx RaiseException OutputDebugStringW InitializeSListHead GetCurrentProcessId GetStartupInfoW GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WideCharToMultiByte MultiByteToWideChar GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId EncodePointer EnterCriticalSection LeaveCriticalSection LCMapStringEx CompareStringEx GetCPInfo QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW

user32

CreateWindowExW RegisterClassExW TranslateAcceleratorW LoadAcceleratorsW GetForegroundWindow UnhookWinEvent SetWinEventHook PostThreadMessageW TranslateMessage GetMessageW GetWindowThreadProcessId RegisterDeviceNotificationW UpdateWindow GetRawInputData RegisterRawInputDevices PostQuitMessage DefWindowProcW SendMessageW RegisterPowerSettingNotification ShowWindow DispatchMessageW

shell32

ShellExecuteExW SHGetFolderPathW SHGetPropertyStoreForWindow CommandLineToArgvW

ole32

CoInitializeSecurity CoInitializeEx CoUninitialize PropVariantClear CoCreateInstance

oleaut32

VariantClear VariantInit SysAllocStringByteLen SysStringByteLen SysAllocString SysFreeString

shlwapi

PathFileExistsW PathFindFileNameW

ctlAUXAccess ctlCheckDriverVersion ctlClose ctlEdidManagement ctlEngineGetActivity ctlEngineGetProperties ctlEnumEngineGroups ctlEnumFans ctlEnumFrequencyDomains ctlEnumMemoryModules ctlEnumPowerDomains ctlEnumTemperatureSensors ctlEnumerateDevices ctlEnumerateDisplayOutputs ctlEnumerateMuxDevices ctlFanGetConfig ctlFanGetProperties ctlFanGetState ctlFanSetDefaultMode ctlFanSetFixedSpeedMode ctlFanSetSpeedTableMode ctlFrequencyGetAvailableClocks ctlFrequencyGetProperties ctlFrequencyGetRange ctlFrequencyGetState ctlFrequencyGetThrottleTime ctlFrequencySetRange ctlGetAdaperDisplayEncoderProperties ctlGetBrightnessSetting ctlGetCurrentScaling ctlGetCurrentSharpness ctlGetDeviceProperties ctlGetDisplayProperties ctlGetIntelArcSyncInfoForMonitor ctlGetIntelArcSyncProfile ctlGetLACEConfig ctlGetMuxProperties ctlGetPowerOptimizationCaps ctlGetPowerOptimizationSetting ctlGetSet3DFeature ctlGetSetRetroScaling ctlGetSetVideoProcessingFeature ctlGetSharpnessCaps ctlGetSupported3DCapabilities ctlGetSupportedRetroScalingCapability ctlGetSupportedScalingCapability ctlGetSupportedVideoProcessingCapabilities ctlGetZeDevice ctlI2CAccess ctlInit ctlMemoryGetBandwidth ctlMemoryGetProperties ctlMemoryGetState ctlOverclockGetProperties ctlOverclockGpuFrequencyOffsetGet ctlOverclockGpuFrequencyOffsetSet ctlOverclockGpuLockGet ctlOverclockGpuLockSet ctlOverclockGpuVoltageOffsetGet ctlOverclockGpuVoltageOffsetSet ctlOverclockPowerLimitGet ctlOverclockPowerLimitSet ctlOverclockTemperatureLimitGet ctlOverclockTemperatureLimitSet ctlOverclockVramFrequencyOffsetGet ctlOverclockVramFrequencyOffsetSet ctlOverclockVramVoltageOffsetGet ctlOverclockVramVoltageOffsetSet ctlOverclockWaiverSet ctlPanelDescriptorAccess ctlPciGetProperties ctlPciGetState ctlPixelTransformationGetConfig ctlPixelTransformationSetConfig ctlPowerGetEnergyCounter ctlPowerGetLimits ctlPowerGetProperties ctlPowerSetLimits ctlPowerTelemetryGet ctlReservedCall ctlSetBrightnessSetting ctlSetCurrentScaling ctlSetCurrentSharpness ctlSetIntelArcSyncProfile ctlSetLACEConfig ctlSetPowerOptimizationSetting ctlSetRuntimePath ctlSoftwarePSR ctlSwitchMux ctlTemperatureGetProperties ctlTemperatureGetState ctlWaitForPropertyChange

Name

.text

Size

382KB

Virtual Size

382KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

122KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

564KB

Virtual Size

564KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_7fbc1a1ca9f3b66154143f5adeb943ce_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

wtsapi32

userenv

advapi32

powrprof

pdh

dxgi

wevtapi

kernel32

user32

shell32

ole32

oleaut32

shlwapi

generic