2026-08-20_863c5fdd7a6297259915e8118c4a4994_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_863c5fdd7a6297259915e8118c4a4994_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.4MB
Sample260820-hs9rvsvsct
SHA256 4bca7f5565aab81ebfbac77c90e2e47f637c4db15aa442174aed9ecaf918a7c2
MD5 863c5fdd7a6297259915e8118c4a4994
SHA1 b00c17b122746478298535f57c7d98be506c09d9
SHA512 fcf72aef2e9657afa23801758f026b0f5a034b1d68c10537af2abefffd221db9cd89228c22d580cc7649c45cc487af7020d40cae2b649154c244a30330c92e1d
SSDEEP 24576:CiqLLY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JoYLNiXicJFFRGNzj3
TLSH
T12F650159739400F5E5BB8239C9A10915F6727C190B219ADF03A0537AEF37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_863c5fdd7a6297259915e8118c4a4994_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-20_863c5fdd7a6297259915e8118c4a4994_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.4MB

2026-08-20_863c5fdd7a6297259915e8118c4a4994_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 670ffa926add928b20a052e0ed28bacd
SHA256 4bca7f5565aab81ebfbac77c90e2e47f637c4db15aa442174aed9ecaf918a7c2
MD5 863c5fdd7a6297259915e8118c4a4994
SHA1 b00c17b122746478298535f57c7d98be506c09d9
SHA512 fcf72aef2e9657afa23801758f026b0f5a034b1d68c10537af2abefffd221db9cd89228c22d580cc7649c45cc487af7020d40cae2b649154c244a30330c92e1d
SSDEEP 24576:CiqLLY/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:JoYLNiXicJFFRGNzj3
TLSH
T12F650159739400F5E5BB8239C9A10915F6727C190B219ADF03A0537AEF37BE19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Git\WindowsDriver6\WindowsDriver\BTDevManagerRefactor\x64\Release\RtkBtManServ.pdb

kernel32

WriteConsoleW GetLocalTime GetTempPathW SetErrorMode GetModuleHandleExW GetCurrentProcess CreateDirectoryW SetUnhandledExceptionFilter GetCurrentProcessId Sleep GetModuleFileNameW GetTickCount64 WaitForMultipleObjects GetOverlappedResult GetLastError HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx CreateFileW DeviceIoControl ResetEvent CloseHandle SetEvent CreateEventW GetCurrentThreadId WaitForSingleObject lstrcmpiW GetStringTypeW SetStdHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree FlsAlloc FlsGetValue FlsSetValue FlsFree GetProcAddress MultiByteToWideChar WideCharToMultiByte RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap

advapi32

OpenServiceW RegisterTraceGuidsW UnregisterTraceGuids GetTraceEnableFlags GetTraceLoggerHandle TraceMessage StartServiceCtrlDispatcherW StartServiceW ControlService DeleteService RegisterServiceCtrlHandlerExW CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW SetServiceStatus ChangeServiceConfig2W GetTraceEnableLevel

ole32

CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoCreateInstance CoUninitialize

oleaut32

VariantClear SysFreeString SysAllocString

cfgmgr32

CM_Get_Device_ID_List_SizeW CM_Get_Device_ID_ListW CM_Get_Device_Interface_List_SizeW CM_Get_DevNode_Status CM_Register_Notification CM_Get_Device_Interface_ListW CM_Unregister_Notification CM_Locate_DevNodeW

dbghelp

MiniDumpWriteDump

Name

.text

Size

124KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_863c5fdd7a6297259915e8118c4a4994_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

advapi32

ole32

oleaut32

cfgmgr32

dbghelp

generic