2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 1.2MB
Sample260819-yt22easdnd
SHA256 183caaec17b302ef391db362a269a319af04ae4b3af3d74bee739f6168adc8a2
MD5 41a45d47ba128520743e0e488da02180
SHA1 29b371451985fdcc4f0015aa45af289de15edcbf
SHA512 34f48edc7f42445b8e482112726f33009d756d47268d96233a284027a30fae500d20bf082cee5b90e51dcadf9fdbae35c4154b5a949a4b0d4960161ed3bc7d6d
SSDEEP 24576:jh01rHVGAxUqVpHi/oSsqjnhMgeiCl7G0nehbGZpbD:jinGAHVpHFWDmg27RnWGj
TLSH
T19345D056B3D402F9D077D17ACA568A65FBB3B8064730A7CB03E446962F276E04B3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 1.2MB

2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 3dd526e6d104ef6b8ef2d7ab23d69c4d
SHA256 183caaec17b302ef391db362a269a319af04ae4b3af3d74bee739f6168adc8a2
MD5 41a45d47ba128520743e0e488da02180
SHA1 29b371451985fdcc4f0015aa45af289de15edcbf
SHA512 34f48edc7f42445b8e482112726f33009d756d47268d96233a284027a30fae500d20bf082cee5b90e51dcadf9fdbae35c4154b5a949a4b0d4960161ed3bc7d6d
SSDEEP 24576:jh01rHVGAxUqVpHi/oSsqjnhMgeiCl7G0nehbGZpbD:jinGAHVpHFWDmg27RnWGj
TLSH
T19345D056B3D402F9D077D17ACA568A65FBB3B8064730A7CB03E446962F276E04B3E316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

79172

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\constructicon\builds\gfx\three\25.10\drivers\2d\dal\eeu\cmake_bridge\wNow64a\cmake_build\build\service\Release\atiesrxx.pdb

advapi32

CreateProcessAsUserA OpenThreadToken AdjustTokenPrivileges ImpersonateSelf LookupPrivilegeValueA CloseServiceHandle CreateServiceA DeleteService OpenSCManagerA OpenServiceA RegisterServiceCtrlHandlerExA SetServiceStatus StartServiceCtrlDispatcherA OpenProcessToken EventRegister EventUnregister EventWriteTransfer ImpersonateLoggedOnUser InitializeSecurityDescriptor RevertToSelf SetSecurityDescriptorDacl RegCloseKey RegOpenCurrentUser RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegOpenKeyExA RegSetValueExA RegSetValueExW RegGetValueA RegGetValueW RegEnumValueA SetEntriesInAclW FreeSid AllocateAndInitializeSid RegNotifyChangeKeyValue

wtsapi32

WTSFreeMemory WTSQuerySessionInformationA WTSEnumerateProcessesA WTSQueryUserToken

psapi

EnumProcessModules GetModuleInformation GetModuleBaseNameA

userenv

LoadUserProfileA UnloadUserProfile

powrprof

PowerReadDCValueIndex PowerEnumerate PowerReadACValueIndex PowerWriteACValueIndex PowerWriteDCValueIndex PowerGetActiveScheme PowerSetActiveScheme PowerSettingAccessCheck

setupapi

SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList CM_Reenumerate_DevNode CM_Locate_DevNodeA SetupDiSetClassInstallParamsA SetupDiGetHwProfileList SetupDiCallClassInstaller CM_Get_DevNode_Status CM_Get_Device_ID_ExA SetupDiGetDeviceRegistryPropertyA SetupDiGetClassDevsA

dwmapi

DwmIsCompositionEnabled

shlwapi

StrStrIA

kernel32

ReadConsoleW ReadFile SetFilePointerEx GetFileSizeEx SetConsoleCtrlHandler GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW OutputDebugStringW WideCharToMultiByte GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect RtlCaptureStackBackTrace GetCurrentProcess FreeLibrary GetModuleHandleA GetProcAddress SetDefaultDllDirectories lstrcmpiA HeapSize WaitForSingleObject GetSystemDirectoryA MapViewOfFile UnmapViewOfFile CreateFileMappingA WTSGetActiveConsoleSessionId GetLastError GetCurrentThread GetModuleFileNameA GetFirmwareEnvironmentVariableA SetFirmwareEnvironmentVariableA FreeResource LoadResource LockResource FindResourceExA GetSystemDefaultLangID GetEnvironmentVariableA GetFileAttributesA CloseHandle TerminateProcess CreateProcessA OpenProcess QueryFullProcessImageNameA CreateToolhelp32Snapshot Process32First Process32Next SetEvent ResetEvent CreateEventA OpenEventA WaitForMultipleObjects LoadLibraryExA LoadLibraryA OutputDebugStringA GetLocalTime ReleaseMutex CreateMutexA OpenMutexA CreateThread SetThreadPriority TerminateThread LocalFree Sleep VerSetConditionMask DeleteFileA FindClose FindFirstFileA FindNextFileA RemoveDirectoryA GetWindowsDirectoryA VerifyVersionInfoW GetCurrentProcessId GetPackageFamilyName ExpandEnvironmentStringsA CreateFileA QueryPerformanceCounter QueryPerformanceFrequency DeviceIoControl LocalAlloc InitializeCriticalSectionEx IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetTempPathW GetFileType HeapAlloc HeapFree GetCommandLineW GetCommandLineA HeapReAlloc WriteConsoleW SetEndOfFile CreateFileW RegisterApplicationRecoveryCallback GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW RtlUnwind

user32

SetSysColors SystemParametersInfoA RegisterDeviceNotificationA UnregisterDeviceNotification RegisterPowerSettingNotification UnregisterPowerSettingNotification PostMessageA PostThreadMessageA GetSysColor RedrawWindow

Name

.text

Size

473KB

Virtual Size

473KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

memcpy_

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_c

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_d

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_41a45d47ba128520743e0e488da02180_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

advapi32

wtsapi32

psapi

userenv

powrprof

setupapi

dwmapi

shlwapi

kernel32

user32

generic