2026-09-04_39504546d6f703c97828b23034bb944e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_39504546d6f703c97828b23034bb944e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 2.8MB
Sample260905-raryrsdm8x
SHA256 b0a8fc8df99e7ed6295c6e75237ed83f6402efa2ceb26ba19e9e13b26ac0d81f
MD5 39504546d6f703c97828b23034bb944e
SHA1 8cda493deb817c6d92e8547c48bc03724c6b94b9
SHA512 02cbc1b3d13045cde5be9de29a9e06f4074d2ae29c871a5a171748bb9b618dd024a790c73cc1b38c2350f86b86d15a9be26de44388c44f132979e9e0697d9821
SSDEEP 49152:IMGVh9Fj6A3bEbGpibGs5+XHqhiRA3hikjtd9WWZXCnb9N+fd:IPbWA3OGp+3fRTteW1Cm
TLSH
T1FFD51255FBA800FCE167D27CC8264E07E776B85A03619ACF03A95956AF232D09D3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_39504546d6f703c97828b23034bb944e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-09-04_39504546d6f703c97828b23034bb944e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 2.8MB

2026-09-04_39504546d6f703c97828b23034bb944e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH d47c040c21b2f2dd675f39feda68cbe7
SHA256 b0a8fc8df99e7ed6295c6e75237ed83f6402efa2ceb26ba19e9e13b26ac0d81f
MD5 39504546d6f703c97828b23034bb944e
SHA1 8cda493deb817c6d92e8547c48bc03724c6b94b9
SHA512 02cbc1b3d13045cde5be9de29a9e06f4074d2ae29c871a5a171748bb9b618dd024a790c73cc1b38c2350f86b86d15a9be26de44388c44f132979e9e0697d9821
SSDEEP 49152:IMGVh9Fj6A3bEbGpibGs5+XHqhiRA3hikjtd9WWZXCnb9N+fd:IPbWA3OGp+3fRTteW1Cm
TLSH
T1FFD51255FBA800FCE167D27CC8264E07E776B85A03619ACF03A95956AF232D09D3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables referencing combination of virtualization drivers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

129572

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

IsWindowVisible GetSystemMetrics EnumDisplayDevicesA wsprintfA

shell32

SHGetFolderPathA ShellExecuteA SHGetSpecialFolderPathA ShellExecuteExA ShellExecuteW

advapi32

GetUserNameA CryptHashData CryptDestroyHash SetSecurityDescriptorDacl CryptAcquireContextA RegCloseKey RegGetValueA RegQueryValueExA CryptGenRandom ConvertStringSecurityDescriptorToSecurityDescriptorA CryptCreateHash GetTokenInformation CryptReleaseContext CryptGetHashParam SetFileSecurityA RegOpenKeyExA InitializeSecurityDescriptor OpenProcessToken

bcrypt

BCryptDestroyKey BCryptGenRandom BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptSetProperty BCryptCreateHash BCryptDecrypt BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey

winhttp

WinHttpQueryDataAvailable WinHttpOpen WinHttpSendRequest WinHttpConnect WinHttpSetTimeouts WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpReceiveResponse

shlwapi

StrStrIA

kernel32

GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileAttributesExW CreateProcessW ReadConsoleW ReadConsoleInputW GetSystemFirmwareTable ReadFile GetModuleFileNameA SizeofResource MoveFileA GetFileSizeEx WriteProcessMemory VirtualProtect SetConsoleTitleA SetEndOfFile GetStdHandle WriteFile SetConsoleMode GetConsoleCursorInfo DeviceIoControl TerminateProcess Thread32Next SetFilePointer Thread32First WaitForSingleObject UnmapViewOfFile GetModuleHandleA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetConsoleMode GetTempPathA GetModuleHandleExA GetTickCount64 GetLastError GetFileAttributesA SetConsoleCursorInfo Process32NextW MoveFileExA CreateFileA GetCurrentThread LoadLibraryA LockResource DeleteFileA Process32FirstW CloseHandle RaiseException GetSystemInfo CreateThread LoadResource FindResourceW SetFileAttributesA GetThreadContext Beep GetProcAddress VirtualAllocEx LocalFree GetFileSize RemoveDirectoryA ExitProcess SetEnvironmentVariableA RtlUnwind GlobalMemoryStatusEx WideCharToMultiByte GetConsoleWindow CreateRemoteThread CreateProcessA GetDiskFreeSpaceExA CreateDirectoryA VirtualFreeEx CreateFileMappingW MapViewOfFile GetTickCount OpenThread IsDebuggerPresent CheckRemoteDebuggerPresent FlushFileBuffers GetExitCodeProcess CreateFileW GetCurrentProcess GetCurrentProcessId GetConsoleOutputCP HeapFree HeapAlloc GetFileType SetFilePointerEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetConsoleCP GetModuleHandleExW GetModuleFileNameW GetCommandLineA GetCommandLineW

iphlpapi

GetAdaptersInfo

setupapi

SetupDiGetDeviceInstanceIdA SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

Name

.text

Size

287KB

Virtual Size

287KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_39504546d6f703c97828b23034bb944e_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

user32

shell32

advapi32

bcrypt

winhttp

shlwapi

kernel32

iphlpapi

setupapi

generic