2026-08-15_8ec17a5d24fbeeaf4cf1dc96c9bb4498_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-15_8ec17a5d24fbeeaf4cf1dc96c9bb4498_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 931KB
Sample260815-d4hejayakg
SHA256 850324ef7219e7aea0dba9cd494d78ba5fcfbb9ef80bd2140b374681ffbf9dd4
MD5 8ec17a5d24fbeeaf4cf1dc96c9bb4498
SHA1 fc2f986bf40e00ae46a2d9f46988e9fa2dbd2e75
SHA512 56b9fb9c480b5446548e1c12ab32f7c224585f2c36c256c23804cd0e0f7f3d8d663609decefa4b640fb647d3ca8d466a0bd22542201c2bd5fa24402adbf3abfd
SSDEEP 24576:s1Y5jnkJE+L5sT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:syehsTLNiXicJFFRGNzj3
TLSH
T1CB15E015F3E404F9E5B78138C9628505F671BC690BA09BEF13A05A4E2F336D19D3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_8ec17a5d24fbeeaf4cf1dc96c9bb4498_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-15_8ec17a5d24fbeeaf4cf1dc96c9bb4498_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 931KB

2026-08-15_8ec17a5d24fbeeaf4cf1dc96c9bb4498_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH fd66348b3d9c20e729051fee2ea872ee
SHA256 850324ef7219e7aea0dba9cd494d78ba5fcfbb9ef80bd2140b374681ffbf9dd4
MD5 8ec17a5d24fbeeaf4cf1dc96c9bb4498
SHA1 fc2f986bf40e00ae46a2d9f46988e9fa2dbd2e75
SHA512 56b9fb9c480b5446548e1c12ab32f7c224585f2c36c256c23804cd0e0f7f3d8d663609decefa4b640fb647d3ca8d466a0bd22542201c2bd5fa24402adbf3abfd
SSDEEP 24576:s1Y5jnkJE+L5sT/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:syehsTLNiXicJFFRGNzj3
TLSH
T1CB15E015F3E404F9E5B78138C9628505F671BC690BA09BEF13A05A4E2F336D19D3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

81408

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qb\workspace\21461\source\output\dump64\gfxui\WindowsServiceModule\igfxCUIService\Release\igfxCUIService.pdb

kernel32

GetSystemDirectoryW lstrlenW SetEndOfFile WriteConsoleW CreateFileW ReadConsoleW CreateProcessW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP SetFileAttributesW RemoveDirectoryW FindNextFileW GetFileAttributesW FindFirstFileW FindClose DeleteFileW CreateDirectoryW MultiByteToWideChar WTSGetActiveConsoleSessionId GetSystemPowerStatus lstrcmpiW FindResourceW SizeofResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary GetTickCount GetCurrentThreadId GetCurrentThread CreateThread GetCurrentProcess Sleep CreateEventW WaitForSingleObject SetEvent LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc CloseHandle ReadFile CreateFileA GetCommandLineW GlobalFree GlobalLock GlobalUnlock GlobalAlloc SetLastError DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException DecodePointer IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType WriteFile GetStdHandle GetFileAttributesExW GetModuleHandleExW ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc RtlPcToFileHeader RtlUnwindEx GetCPInfo LCMapStringEx EncodePointer GetStringTypeW WideCharToMultiByte GetStartupInfoW InitializeSListHead IsDebuggerPresent OutputDebugStringW InitializeCriticalSectionAndSpinCount RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind

user32

MessageBoxW CharNextW CharUpperW PostThreadMessageW UnregisterDeviceNotification GetMessageW RegisterDeviceNotificationW DispatchMessageW LoadStringW TranslateMessage

gdi32

D3DKMTCloseAdapter D3DKMTOpenAdapterFromDeviceName D3DKMTEscape

advapi32

SetSecurityDescriptorDacl SetNamedSecurityInfoW GetNamedSecurityInfoW SetEntriesInAclW ConvertSecurityDescriptorToStringSecurityDescriptorW ConvertStringSecurityDescriptorToSecurityDescriptorW StartServiceW RevertToSelf ImpersonateLoggedOnUser DuplicateTokenEx AllocateAndInitializeSid CreateProcessAsUserW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceStatusEx OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW ReportEventW RegisterEventSourceW DeregisterEventSource SetSecurityDescriptorOwner SetSecurityDescriptorGroup IsValidSid InitializeSecurityDescriptor GetTokenInformation GetLengthSid CopySid AdjustTokenPrivileges OpenThreadToken OpenProcessToken

ole32

CoUninitialize CoInitializeEx CoRegisterClassObject CoRevokeClassObject CoResumeClassObjects CoAddRefServerProcess CoReleaseServerProcess CoInitializeSecurity CoCreateInstance CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree PropVariantClear StringFromGUID2

oleaut32

SysFreeString SysAllocString SysStringLen VarUI4FromStr LoadTypeLi LoadRegTypeLi RegisterTypeLi UnRegisterTypeLi SysAllocStringLen VarBstrCat

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiOpenDevRegKey

shlwapi

PathFileExistsW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

version

VerQueryValueW GetFileVersionInfoExW GetFileVersionInfoSizeExW

wtsapi32

WTSQueryUserToken

Name

.text

Size

223KB

Virtual Size

222KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-15_8ec17a5d24fbeeaf4cf1dc96c9bb4498_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

gdi32

advapi32

ole32

oleaut32

setupapi

shlwapi

userenv

version

wtsapi32

generic