2026-08-31_ff5d0d517e141a3959e5a34551d45703_cobalt-strike_icedid_luca-stealer_ngrbot_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-31_ff5d0d517e141a3959e5a34551d45703_cobalt-strike_icedid_luca-stealer_ngrbot_njrat_satacom_stealc_vidar
Size 1.1MB
Sample260901-2jnmtasybv
SHA256 8edac7cff480cdb5c071e69ff5bc4814e1d712303c4bbb6b8ffe06273ed00fa9
MD5 ff5d0d517e141a3959e5a34551d45703
SHA1 3021307707a4cf08f9b841aa98853f3860e35d72
SHA512 46521e52032afc5ec1c6829e37c4028c3ce9e0048ba61223dfee607571fde25a18aa29641efbc010214be1075a6b5a376deeba8db0a0d26491276342005e3d80
SSDEEP 24576:Pc2jGzeepemjEJk+YMANGqXSSMlYu+OH6Uum3Ugud:U7pEJbVYul6VmVu
TLSH
T1CF45383975FCE2E6E426C134991257B2A9707C96D320E7FB1E92720A1E316E12E3D731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-31_ff5d0d517e141a3959e5a34551d45703_cobalt-strike_icedid_luca-stealer_ngrbot_njrat_satacom_stealc_vidar

File Explorer

2026-08-31_ff5d0d517e141a3959e5a34551d45703_cobalt-strike_icedid_luca-stealer_ngrbot_njrat_satacom_stealc_vidar

.exe 1.1MB

2026-08-31_ff5d0d517e141a3959e5a34551d45703_cobalt-strike_icedid_luca-stealer_ngrbot_njrat_satacom_stealc_vidar

IMPHASH a6275e72c585a997512bee1cee9f1fab
SHA256 8edac7cff480cdb5c071e69ff5bc4814e1d712303c4bbb6b8ffe06273ed00fa9
MD5 ff5d0d517e141a3959e5a34551d45703
SHA1 3021307707a4cf08f9b841aa98853f3860e35d72
SHA512 46521e52032afc5ec1c6829e37c4028c3ce9e0048ba61223dfee607571fde25a18aa29641efbc010214be1075a6b5a376deeba8db0a0d26491276342005e3d80
SSDEEP 24576:Pc2jGzeepemjEJk+YMANGqXSSMlYu+OH6Uum3Ugud:U7pEJbVYul6VmVu
TLSH
T1CF45383975FCE2E6E426C134991257B2A9707C96D320E7FB1E92720A1E316E12E3D731
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

519104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Process32Next FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation HeapReAlloc ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType GetCurrentProcessorNumberEx EnterCriticalSection GetSystemTimeAdjustment LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection HeapSize GetSystemTimeAsFileTime QueryPerformanceCounter InitializeSListHead InterlockedPopEntrySList InitializeSRWLock ReleaseSRWLockExclusive Process32First AcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared InterlockedPushEntrySList CreateToolhelp32Snapshot QueryDepthSList WaitForSingleObject CreateEventA GetCurrentThreadId SetEvent ResetEvent SetThreadPriority CreateThread SetThreadIdealProcessor SetThreadGroupAffinity EnumSystemLocalesW HeapCreate SetEndOfFile MultiByteToWideChar GetLogicalProcessorInformationEx GetUserDefaultLCID QueryPerformanceFrequency CreateFileMappingA HeapDestroy GlobalMemoryStatusEx GetProcAddress CloseThreadpoolWait WaitForThreadpoolWaitCallbacks CreateThreadpoolWait GetModuleHandleW GetModuleHandleA GetModuleFileNameW UnmapViewOfFile IsValidLocale GetLocaleInfoW IsValidCodePage CompareStringW GetTimeFormatW GetDateFormatW GetCommandLineW GetCommandLineA WriteFile GetStdHandle FreeLibraryAndExitThread ExitThread MapViewOfFile GetModuleHandleExW ExitProcess RtlUnwind LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc GetACP RtlUnwindEx RaiseException PostQueuedCompletionStatus GetQueuedCompletionStatusEx CreateIoCompletionPort RtlPcToFileHeader VirtualFree VirtualAlloc GetCurrentProcessId TerminateProcess IsProcessorFeaturePresent LoadLibraryA GetStartupInfoW FreeLibrary SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry SetFileCompletionNotificationModes GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW WriteProcessMemory VirtualProtectEx RtlCaptureContext VirtualAllocEx VirtualProtect GetProcessHandleCount OpenProcess GetCurrentProcess Sleep GetProcessHeap CreateFileA HeapFree HeapAlloc CreateEventW InitializeCriticalSectionAndSpinCount SetLastError GetLastError DuplicateHandle GetCPInfo SetEnvironmentVariableW InterlockedFlushSList GetActiveProcessorGroupCount InterlockedPushListSListEx SetStdHandle CancelIoEx GetActiveProcessorCount LCMapStringEx DecodePointer LCMapStringW EncodePointer CloseHandle CreateFileW SetThreadpoolWait WideCharToMultiByte LocalFree FlsFree FlsSetValue FlsGetValue FlsAlloc WaitForSingleObjectEx GetExitCodeThread TryAcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetStringTypeW InitializeCriticalSectionEx WriteConsoleW

user32

MessageBoxW GetCursorPos

ole32

CoUninitialize CoCreateInstance CoInitializeEx CoInitializeSecurity CoSetProxyBlanket

oleaut32

SysAllocString SysFreeString SafeArrayAccessData SafeArrayUnaccessData SafeArrayGetLBound SafeArrayGetUBound VariantClear

ws2_32

shutdown WSASocketW getsockname WSARecv WSASend setsockopt FreeAddrInfoW GetAddrInfoW WSAIoctl closesocket bind WSACleanup connect WSAGetLastError inet_pton WSAStartup recv getsockopt htonl send socket htons

ntdll

RtlIpv6AddressToStringExA RtlIpv4StringToAddressExA RtlIpv4AddressToStringExA RtlIpv6StringToAddressExA RtlNtStatusToDosError RtlInitUnicodeString NtSetInformationThread

advapi32

EventWriteTransfer RegOpenKeyExA EventUnregister RegQueryValueExA RegCloseKey RegNotifyChangeKeyValue EventRegister

iphlpapi

ConvertInterfaceIndexToLuid ConvertInterfaceLuidToAlias GetIfTable2 FreeMibTable ResolveIpNetEntry2 GetBestRoute2 GetIpNetEntry2 GetAdaptersAddresses GetCurrentThreadCompartmentId SetCurrentThreadCompartmentId

winmm

timeGetDevCaps

bcrypt

BCryptDestroyHash BCryptGenerateSymmetricKey BCryptFinishHash BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptGenRandom BCryptSetProperty BCryptCreateHash BCryptHashData BCryptCloseAlgorithmProvider

secur32

FreeCredentialsHandle SetCredentialsAttributesW FreeContextBuffer QuerySecurityContextToken DeleteSecurityContext AcceptSecurityContext QueryContextAttributesW AcquireCredentialsHandleW InitializeSecurityContextW

crypt32

CertCloseStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFindCertificateInStore CertSaveStore CertGetCertificateChain CertFreeCertificateContext CertOpenStore CertGetCertificateContextProperty CertGetNameStringA CertFreeCertificateChain CertAddCertificateLinkToStore

sspicli

QueryContextAttributesExW

Name

.text

Size

674KB

Virtual Size

674KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

250KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

45KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

156KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-31_ff5d0d517e141a3959e5a34551d45703_cobalt-strike_icedid_luca-stealer_ngrbot_njrat_satacom_stealc_vidar

kernel32

user32

ole32

oleaut32

ws2_32

ntdll

advapi32

iphlpapi

winmm

bcrypt

secur32

crypt32

sspicli

generic