2026-08-25_f07d6a7558ec82238ff2086f2030402f_cobalt-strike_icedid_luca-stealer_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_f07d6a7558ec82238ff2086f2030402f_cobalt-strike_icedid_luca-stealer_njrat_vidar
Size 2.1MB
Sample260826-dev94a1hlg
SHA256 54dc6b03947aadbcd04e0a77deb12a586d81a7fa6ca4d43a5c1c5cca2b7d0b28
MD5 f07d6a7558ec82238ff2086f2030402f
SHA1 81bf344067ed8864b89fe61fb3cdba7d9c5abfb3
SHA512 1fa86f21308e3cbc4eec2bc9d257380bd5c626386d37c454ee53796e07bf7aa06e6f8284ed6aba5453531f8d237a7581a8bec4b29c2bd289e77af7de8ef9d2fd
SSDEEP 49152:m9CPf6bTOz4dZMJJrpk+YIiwdWVTw6FOEwUuNSmG:EOMdZmK+Y66BBRP
TLSH
T1D3A5D0B2B7B026FDD0B6823AE5988120FEB87D4D37E0516AC964B16D0F7B46552BF300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-25_f07d6a7558ec82238ff2086f2030402f_cobalt-strike_icedid_luca-stealer_njrat_vidar

.exe 2.1MB

2026-08-25_f07d6a7558ec82238ff2086f2030402f_cobalt-strike_icedid_luca-stealer_njrat_vidar

IMPHASH ce84c1f64bcbfa32d75b59c70fcf8667
SHA256 54dc6b03947aadbcd04e0a77deb12a586d81a7fa6ca4d43a5c1c5cca2b7d0b28
MD5 f07d6a7558ec82238ff2086f2030402f
SHA1 81bf344067ed8864b89fe61fb3cdba7d9c5abfb3
SHA512 1fa86f21308e3cbc4eec2bc9d257380bd5c626386d37c454ee53796e07bf7aa06e6f8284ed6aba5453531f8d237a7581a8bec4b29c2bd289e77af7de8ef9d2fd
SSDEEP 49152:m9CPf6bTOz4dZMJJrpk+YIiwdWVTw6FOEwUuNSmG:EOMdZmK+Y66BBRP
TLSH
T1D3A5D0B2B7B026FDD0B6823AE5988120FEB87D4D37E0516AC964B16D0F7B46552BF300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

36:e5:4c:e1:8d:80:35:3c:e0:d4:9d:17:13:22:92:9f:a1:6f:a1:89:93:86:05:2c:e9:ae:1c:4b:f2:9f:ac:3d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=1067879,CN=Logitech Inc,O=Logitech Inc,L=Newark,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Sep 23, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Serial Number

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 2, 2023 - Oct 30, 2034

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

Serial Number

01:1b:a1:29:71:e5:10:ea:76:cd:ce:11:65:6b:fe:7e

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 14, 2022 - Jun 13, 2025

Minor OS version

Major OS version

Entry point

352224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

D:\a\wix\wix\build\burn\Release\x64\burn.pdb

kernel32

InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseMutex CreateEventW CreateSemaphoreW GetCurrentProcess CreateThread GetNativeSystemInfo CompareStringW VerSetConditionMask GetSystemTime GetComputerNameW VerifyVersionInfoW GetDateFormatW GetUserDefaultUILanguage GetUserDefaultLangID GetSystemDefaultLangID GetStringTypeW CreateProcessW DuplicateHandle ProcessIdToSessionId ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW OpenProcess GetProcessId SetProcessShutdownParameters LocalFileTimeToFileTime GetExitCodeThread DosDateTimeToFileTime CompareStringA SetThreadExecutionState ReleaseSemaphore CreateMutexW GetExitCodeProcess CreateFileMappingW MapViewOfFile UnmapViewOfFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx FreeLibrary InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RtlPcToFileHeader GetStdHandle GetModuleHandleExW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle FlsAlloc FlsGetValue FlsSetValue FlsFree FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW VirtualQuery VirtualProtect GetSystemInfo RaiseException ExpandEnvironmentStringsW GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc GetModuleFileNameW GetSystemWow64DirectoryW GetSystemDirectoryW GetLocalTime SetLastError GetTempPathW GetVolumePathNameW GetTempFileNameW GetFullPathNameW CopyFileW GlobalFree GlobalAlloc Sleep SetFileTime SetFilePointerEx SetEndOfFile ReadFile LoadLibraryExA GetFileSizeEx LCMapStringW WideCharToMultiByte MultiByteToWideChar lstrlenW FormatMessageW LocalFree MoveFileExW SetFileAttributesW RemoveDirectoryW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateDirectoryW GetCurrentDirectoryW LoadLibraryExW GetProcAddress GetModuleHandleW WaitForMultipleObjects WaitForSingleObject HeapSetInformation GetLastError lstrlenA GetCurrentProcessId GetModuleHandleA MulDiv CompareStringOrdinal GetSystemWindowsDirectoryW LoadResource LockResource SizeofResource FindResourceExA VirtualAlloc VirtualFree SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetTimeZoneInformation WriteFile SetFilePointer CreateFileA ExitProcess CloseHandle CreateFileW

user32

GetDC ReleaseDC MonitorFromPoint ShowWindow IsDialogMessageW LoadBitmapW SetWindowLongPtrW GetWindowLongPtrW GetCursorPos MessageBoxW SetWindowPos CreateWindowExW UnregisterClassW RegisterClassW PostQuitMessage DefWindowProcW DispatchMessageW TranslateMessage GetMessageW WaitForInputIdle IsWindow PostMessageW GetMonitorInfoW LoadCursorW MonitorFromWindow

gdi32

DeleteObject SelectObject StretchBlt GetObjectW DeleteDC CreateDCW CreateCompatibleDC GetDeviceCaps

advapi32

GetUserNameW CryptAcquireContextW CryptReleaseContext QueryServiceConfigW CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash OpenProcessToken AllocateAndInitializeSid CheckTokenMembership GetTokenInformation AdjustTokenPrivileges IsWellKnownSid LookupPrivilegeValueW RegCreateKeyExW QueryServiceStatus OpenServiceW OpenSCManagerW ControlService CloseServiceHandle ChangeServiceConfigW SetEntriesInAclW DecryptFileW InitializeAcl CreateWellKnownSid ConvertStringSecurityDescriptorToSecurityDescriptorW ReportEventW OpenEventLogW CloseEventLog RegQueryInfoKeyW RegDeleteValueW RegQueryValueExW InitiateSystemShutdownExW RegOpenKeyExW RegCloseKey SetNamedSecurityInfoW RegDeleteKeyW RegEnumKeyExW RegEnumValueW RegSetValueExW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetEntriesInAclA

ole32

CoInitializeEx CoInitialize CoInitializeSecurity CoUninitialize CLSIDFromProgID CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

VariantClear SysFreeString VariantInit SysAllocString

rpcrt4

UuidCreate

shell32

CommandLineToArgvW ShellExecuteExW SHGetFolderPathW

Name

.text

Size

508KB

Virtual Size

507KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

217KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

408B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wixburn

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_f07d6a7558ec82238ff2086f2030402f_cobalt-strike_icedid_luca-stealer_njrat_vidar

kernel32

user32

gdi32

advapi32

ole32

oleaut32

rpcrt4

shell32

generic