2026-08-20_a363c120b60c1a3527a21bb779a9d862_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_a363c120b60c1a3527a21bb779a9d862_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 1.6MB
Sample260820-vywhmsgj9z
SHA256 834fd2f380bae7dfc94d627863156f313eaeed536ae148cae251e82d372a3392
MD5 a363c120b60c1a3527a21bb779a9d862
SHA1 0d2d826e00cab9abc8cd23c462d19fdde26fa040
SHA512 80deb79eec03535bf40028cb4df11a4d1b4411c2690479d70480b76e49b0378fb73e0d58265a0547b70e503b65e9789e7ab9b8a72009a23b139402c9008ddd05
SSDEEP 12288:vCydc6q9GDhRwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:VcAtRfHLHUvB60yM/0s+1Krl
TLSH
T14F75014A73A510FAE5B382388D914922F7B2BC61072587DF13A44376AF376D0AD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_a363c120b60c1a3527a21bb779a9d862_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-08-20_a363c120b60c1a3527a21bb779a9d862_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 1.6MB

2026-08-20_a363c120b60c1a3527a21bb779a9d862_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 68c98bbc7ff63e8522dd3cd2da42c378
SHA256 834fd2f380bae7dfc94d627863156f313eaeed536ae148cae251e82d372a3392
MD5 a363c120b60c1a3527a21bb779a9d862
SHA1 0d2d826e00cab9abc8cd23c462d19fdde26fa040
SHA512 80deb79eec03535bf40028cb4df11a4d1b4411c2690479d70480b76e49b0378fb73e0d58265a0547b70e503b65e9789e7ab9b8a72009a23b139402c9008ddd05
SSDEEP 12288:vCydc6q9GDhRwS++9HL+8HrovB6TopsMRdkVG65kI8+Z9P6MvjeUW5MItWOBDW:VcAtRfHLHUvB60yM/0s+1Krl
TLSH
T14F75014A73A510FAE5B382388D914922F7B2BC61072587DF13A44376AF376D0AD3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\BuildAutomation\BCMSecurity_int_cs_5.15\sw\phoenixII\host\windows\BCMSecurity\BCMSecurity\bin\x64\Release\bcmHostStorageService.pdb

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData WTHelperGetProvCertFromChain WinVerifyTrust WTHelperGetProvSignerFromChain

shlwapi

StrStrW

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW

kernel32

FindClose CreateFileW GetLastError DeleteFileW CloseHandle GetFileSize HeapFree GetModuleFileNameW InitializeCriticalSection SetEvent FindNextFileW ResetEvent HeapAlloc GetProcAddress DeleteCriticalSection GetProcessHeap CreateEventA LCMapStringW CompareStringW FindFirstFileW ReadFile CreateDirectoryW GetCurrentProcessId GetLocalTime GetCurrentThreadId LoadLibraryExW LocalFree CreateThread LocalAlloc WaitForSingleObject ExpandEnvironmentStringsW SetStdHandle GetStringTypeW FlushFileBuffers ReadConsoleW HeapSize HeapReAlloc WriteConsoleW SetEndOfFile WriteFile TerminateThread RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx SetLastError EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary RtlPcToFileHeader GetFileAttributesExW ExitProcess GetModuleHandleExW GetStdHandle GetCommandLineA GetCommandLineW GetFileType GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect

user32

RegisterPowerSettingNotification RegisterDeviceNotificationW UnregisterDeviceNotification

advapi32

StartServiceW RegisterServiceCtrlHandlerExW SetSecurityDescriptorDacl CreateServiceW CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid SetServiceStatus ChangeServiceConfig2W DeleteService ControlService FreeSid RegQueryValueExW InitializeSecurityDescriptor InitializeAcl StartServiceCtrlDispatcherW OpenServiceW GetLengthSid AddAccessAllowedAce QueryServiceStatusEx RegCloseKey RegOpenKeyExW

Name

.text

Size

114KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.4MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_a363c120b60c1a3527a21bb779a9d862_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

crypt32

wintrust

shlwapi

setupapi

kernel32

user32

advapi32

generic