2026-08-20_e813555313b63ec0d78b0c2d4b6cd079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_e813555313b63ec0d78b0c2d4b6cd079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 765KB
Sample260820-lezxaatdma
SHA256 6e9ecc3ee899ffd0333a0d56ed65664dc892630cf447c600dc91b7f0c21e1992
MD5 e813555313b63ec0d78b0c2d4b6cd079
SHA1 e6417c5a0c4a76e2352284c770b403f9c7b34531
SHA512 ea08b14d3014789fece709c8a3baa0f44fd198e97fb33c0b8a1cb83b687117971ba697cee71ade19c3bcb5354db6427b12fd93a602e4a70402688e925216e17d
SSDEEP 12288:QTZuW6owXdzkU6FdoSDbJQZ8Py16KPoxy1rMvt6fDVCLoVPVmg:8ZuW6XX6UZSDbOK6160bru0OoVPVB
TLSH
T14EF49D55669C02E5D4BA8435C5424776F1B2BC250BA28BCB42B47B6F0F3B6E05F3EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_e813555313b63ec0d78b0c2d4b6cd079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-20_e813555313b63ec0d78b0c2d4b6cd079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 765KB

2026-08-20_e813555313b63ec0d78b0c2d4b6cd079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 28d3ad9e7b2dd725df12065a08e1370d
SHA256 6e9ecc3ee899ffd0333a0d56ed65664dc892630cf447c600dc91b7f0c21e1992
MD5 e813555313b63ec0d78b0c2d4b6cd079
SHA1 e6417c5a0c4a76e2352284c770b403f9c7b34531
SHA512 ea08b14d3014789fece709c8a3baa0f44fd198e97fb33c0b8a1cb83b687117971ba697cee71ade19c3bcb5354db6427b12fd93a602e4a70402688e925216e17d
SSDEEP 12288:QTZuW6owXdzkU6FdoSDbJQZ8Py16KPoxy1rMvt6fDVCLoVPVmg:8ZuW6XX6UZSDbOK6160bru0OoVPVB
TLSH
T14EF49D55669C02E5D4BA8435C5424776F1B2BC250BA28BCB42B47B6F0F3B6E05F3EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

172112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qb\workspace\21461\source\output\dump64\gfxui\EventManager\igfxEM\Release\igfxEM.pdb

kernel32

GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalUnlock GlobalLock GlobalHandle GlobalFree MulDiv lstrcmpW lstrcmpiW MultiByteToWideChar WideCharToMultiByte DeleteFileW FindClose FindFirstFileW FindNextFileW GetExitCodeThread GetTickCount ExpandEnvironmentStringsW SetFileAttributesW GetSystemDirectoryW CreateDirectoryW OpenEventW GetCurrentProcessId ProcessIdToSessionId GetFileAttributesW CreateProcessW LoadLibraryW WTSGetActiveConsoleSessionId GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetSystemDefaultLangID WriteConsoleW SetEndOfFile CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindFirstFileExW FlushFileBuffers GetOEMCP GetACP IsValidCodePage GetFileSizeEx FindResourceExW SetFilePointerEx ReadConsoleW GetConsoleMode GetTimeZoneInformation GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleHandleExW ExitProcess WriteFile GetStdHandle ReadFile VirtualQuery VirtualProtect GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc RtlPcToFileHeader RtlUnwindEx GetCPInfo LCMapStringEx GetStringTypeW LocalFree GetStartupInfoW GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent GetCurrentThreadId CreateThread Sleep CreateEventW CreateMutexW WaitForSingleObject SetEvent LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc FreeLibrary HeapDestroy DecodePointer SetLastError CloseHandle GetCommandLineW DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException GetConsoleOutputCP RtlUnwind

user32

IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW PostThreadMessageW SendMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW UnregisterClassW GetSystemMetrics GetSubMenu IsChild TrackPopupMenuEx SetMenuDefaultItem SetForegroundWindow GetWindowRect SetWindowContextHelpId MessageBoxW CreateDialogIndirectParamW GetDlgItem CharUpperW GetCursorPos LoadIconW LoadImageW MapDialogRect GetDisplayConfigBufferSizes SetDisplayConfig QueryDisplayConfig DestroyWindow SetWindowPos InsertMenuW MoveWindow CharNextW SetFocus GetFocus SetCapture ReleaseCapture CreateAcceleratorTableW DestroyAcceleratorTable GetDC ReleaseDC BeginPaint EndPaint InvalidateRect InvalidateRgn ClientToScreen RedrawWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW KillTimer SetTimer MapVirtualKeyExW GetKeyNameTextW SendDlgItemMessageW EndDialog CreateDialogParamW IsWindowVisible ShowWindow PostQuitMessage UnregisterDeviceNotification RegisterDeviceNotificationW UnregisterHotKey RegisterHotKey GetKeyboardLayout GetKeyboardLayoutList ActivateKeyboardLayout LoadKeyboardLayoutW MsgWaitForMultipleObjects PeekMessageW FindWindowW DestroyMenu CreatePopupMenu PostMessageW LoadCursorW GetWindow GetClassNameW GetParent GetDesktopWindow SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW GetWindowLongW FillRect GetSysColor ScreenToClient GetClientRect

gdi32

GetObjectW BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteDC DeleteObject GetDeviceCaps SelectObject GetStockObject

advapi32

RegDeleteKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumKeyExW

ole32

CLSIDFromString OleLockRunning OleRun OleUninitialize OleInitialize CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CLSIDFromProgID CoInitializeEx CoCreateInstance CoReleaseServerProcess CoAddRefServerProcess CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoGetClassObject CoUninitialize CreateStreamOnHGlobal

oleaut32

SysAllocStringLen SysStringLen VariantInit VariantClear VarUI4FromStr LoadTypeLi SysAllocString RegisterTypeLi UnRegisterTypeLi OleCreateFontIndirect SysStringByteLen SysAllocStringByteLen LoadRegTypeLi GetErrorInfo SysFreeString

setupapi

SetupDiCreateDeviceInfoList SetupDiGetClassDevsW SetupDiGetDevicePropertyW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiOpenDeviceInfoW SetupDiOpenDevRegKey

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

shell32

Shell_NotifyIconW SHCreateItemFromParsingName

shlwapi

StrStrW

bcrypt

BCryptHashData BCryptCreateHash BCryptFinishHash BCryptDestroyHash BCryptDecrypt BCryptEncrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider BCryptDestroyKey

version

GetFileVersionInfoSizeExW VerQueryValueW GetFileVersionInfoExW

Name

.text

Size

393KB

Virtual Size

392KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

141KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

148KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_e813555313b63ec0d78b0c2d4b6cd079_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

gdi32

advapi32

ole32

oleaut32

setupapi

wtsapi32

shell32

shlwapi

bcrypt

version

generic