2026-08-20_25711d7f0be0c894ce619527e73a299d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_25711d7f0be0c894ce619527e73a299d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.7MB
Sample260820-wrglkswthy
SHA256 f0ff7326cbab859372ae20edaf3235430c3ff47d1af65500c7cc1a5026cd6aa4
MD5 25711d7f0be0c894ce619527e73a299d
SHA1 825173684259bfed2f5e68b52d7476894b5abf74
SHA512 9739cfb5b5b7cb859eeac410c461ad30f1e6e469b7ff7ac3cc2b186ef04590c15e73579c74ccae7baeeb7ca1b3669ac03ca9692da78a5eca2e18fa204627702b
SSDEEP 24576:zs+awK9VcWDX7nbfHLHUvB60yM/0s+1Krl:pawK7DX7nbfYvBHyO0s+2
TLSH
T1DA85F059B39118F9F87B8178CD929612EAB2BC540B61D7DF03B406263F23AD09D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_25711d7f0be0c894ce619527e73a299d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-20_25711d7f0be0c894ce619527e73a299d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.7MB

2026-08-20_25711d7f0be0c894ce619527e73a299d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 0f72ae7d3bb4fe86c4d4d003bf755efa
SHA256 f0ff7326cbab859372ae20edaf3235430c3ff47d1af65500c7cc1a5026cd6aa4
MD5 25711d7f0be0c894ce619527e73a299d
SHA1 825173684259bfed2f5e68b52d7476894b5abf74
SHA512 9739cfb5b5b7cb859eeac410c461ad30f1e6e469b7ff7ac3cc2b186ef04590c15e73579c74ccae7baeeb7ca1b3669ac03ca9692da78a5eca2e18fa204627702b
SSDEEP 24576:zs+awK9VcWDX7nbfHLHUvB60yM/0s+1Krl:pawK7DX7nbfYvBHyO0s+2
TLSH
T1DA85F059B39118F9F87B8178CD929612EAB2BC540B61D7DF03B406263F23AD09D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

60752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\BuildAutomation\USHUpgradeService_int_cs_5.15\sw\int_cs_5.15\host\windows\UshUpgradeService\x64\Release\bcmUshUpgradeService.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdW SetupDiEnumDeviceInterfaces CM_Query_And_Remove_SubTreeW SetupDiDestroyDeviceInfoList CM_Reenumerate_DevNode CM_Locate_DevNodeW SetupDiGetClassDevsW

crypt32

CertGetNameStringW

kernel32

DeleteFileW CreateEventA TerminateProcess GetModuleFileNameW WaitForSingleObject CreateFileW OpenProcess TerminateThread CloseHandle CreateThread GetSystemDirectoryW ResetEvent WTSGetActiveConsoleSessionId VerSetConditionMask VerifyVersionInfoW LoadLibraryExW FreeLibrary FlsGetValue GetFileAttributesW SetStdHandle FindClose RemoveDirectoryW ExpandEnvironmentStringsW FindNextFileW FindFirstFileW CreateDirectoryW LocalFree LocalAlloc GetModuleHandleW SetEvent Sleep GetCurrentProcessId GetLocalTime GetCurrentThreadId GetProcessHeap GetProcAddress HeapAlloc GetLastError HeapFree WriteConsoleW HeapSize FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW HeapReAlloc SetEndOfFile GetFileType FlsAlloc SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP GetCommandLineW GetCommandLineA GetModuleHandleExW ExitProcess IsValidCodePage FindFirstFileExW ReadConsoleInputW SetConsoleMode FlushFileBuffers GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW MultiByteToWideChar WideCharToMultiByte RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ReadFile GetConsoleCP GetStdHandle WriteFile GetConsoleOutputCP

user32

RegisterDeviceNotificationW

advapi32

ChangeServiceConfig2W RegOpenKeyExW DeregisterEventSource CreateProcessAsUserA SetTokenInformation RegCreateKeyExA ReportEventA RegSetValueExA RegDeleteValueW DuplicateTokenEx RegisterEventSourceA RegisterServiceCtrlHandlerExW CreateServiceW SetServiceStatus CopySid ConvertStringSidToSidW StartServiceCtrlDispatcherW LookupAccountSidW QueryServiceStatusEx RegCloseKey RegSetValueExW RegEnumKeyExW RegQueryValueExW RegCreateKeyExW RegQueryInfoKeyW SetSecurityDescriptorDacl AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor InitializeAcl GetLengthSid AddAccessAllowedAce QueryServiceStatus CloseServiceHandle OpenSCManagerW DeleteService ControlService StartServiceW OpenServiceW

shell32

SHGetFolderPathA

ole32

CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

VariantClear SysAllocString SysFreeString

winbio

WinBioCloseSession WinBioEnumBiometricUnits WinBioDeleteTemplate WinBioOpenSession WinBioFree

wintrust

WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData WinVerifyTrust WTHelperGetProvCertFromChain

shlwapi

StrStrW

Name

.text

Size

217KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

33.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

816B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.4MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_25711d7f0be0c894ce619527e73a299d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

version

wtsapi32

userenv

setupapi

crypt32

kernel32

user32

advapi32

shell32

ole32

oleaut32

winbio

wintrust

shlwapi

generic