2026-09-08_bc4ca81a15e775b829f7d6ce7c8f6513_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_bc4ca81a15e775b829f7d6ce7c8f6513_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 1.1MB
Sample260910-dl5r4sdr2x
SHA256 a6ec6b5831beb9dc0d15b212174ad61ffbbf7512d7b6535c0682e53542c1999d
MD5 bc4ca81a15e775b829f7d6ce7c8f6513
SHA1 f863c2e05638799b9f6813f87f0df9abc3f76366
SHA512 58f8cebddbbfdcf7f3c6f4bfdd83db02c288a8dac7c67d183ebdc6612a76fa4fe20467eb629351fb422f3478c8851e357a7fd4f3bc9c9b4dce4194be141952a8
SSDEEP 24576:2bKgpRMoEaZ6lOpiAo02QwP0EJLl3qIAOsjgyDX:vsZr72NsuLGOsj3
TLSH
T12C358E07B3F811E9E077C274C9575617EBB2B45523209BDF43A08A5A2F63BA19E3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_bc4ca81a15e775b829f7d6ce7c8f6513_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-09-08_bc4ca81a15e775b829f7d6ce7c8f6513_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 1.1MB

2026-09-08_bc4ca81a15e775b829f7d6ce7c8f6513_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 1ba9d4154ed23b7587174b5f7c8291e7
SHA256 a6ec6b5831beb9dc0d15b212174ad61ffbbf7512d7b6535c0682e53542c1999d
MD5 bc4ca81a15e775b829f7d6ce7c8f6513
SHA1 f863c2e05638799b9f6813f87f0df9abc3f76366
SHA512 58f8cebddbbfdcf7f3c6f4bfdd83db02c288a8dac7c67d183ebdc6612a76fa4fe20467eb629351fb422f3478c8851e357a7fd4f3bc9c9b4dce4194be141952a8
SSDEEP 24576:2bKgpRMoEaZ6lOpiAo02QwP0EJLl3qIAOsjgyDX:vsZr72NsuLGOsj3
TLSH
T12C358E07B3F811E9E077C274C9575617EBB2B45523209BDF43A08A5A2F63BA19E3D321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Detects executables referencing combination of virtualization drivers
Detects executables referencing many confidential data stores found in browsers, mail clients, crypt
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetSystemDirectoryW CopyFileW GetComputerNameW MultiByteToWideChar WideCharToMultiByte IsDebuggerPresent GlobalMemoryStatusEx GetNativeSystemInfo GetUserDefaultUILanguage GetUserDefaultLangID lstrcatW GetLocalTime GetFileInformationByHandle GetFileType DuplicateHandle GetCurrentProcess OpenProcess CreateFileMappingW MapViewOfFile UnmapViewOfFile GetProcAddress lstrcmpiW CreateToolhelp32Snapshot Process32FirstW Process32NextW LocalFree FreeLibrary LoadLibraryW SetDllDirectoryW WaitForSingleObject Sleep TerminateProcess CreateRemoteThread ResumeThread CreateProcessW VirtualAllocEx ReadProcessMemory WriteProcessMemory GetTickCount Module32NextW GetVersionExW GlobalUnlock GlobalLock FlushFileBuffers QueryPerformanceCounter FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact GetSystemInfo DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapSize HeapValidate UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI RaiseException GetCurrentProcessId CreateMutexW GetProcessHeap HeapFree HeapReAlloc HeapAlloc GetLastError GetTempPathW CloseHandle SetFileAttributesW WriteFile RemoveDirectoryW ReadFile GetFileSizeEx GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CreateFileW CreateDirectoryW GetEnvironmentVariableW GetModuleHandleW Module32FirstW ExitProcess

user32

CloseClipboard GetSystemMetrics wsprintfW wsprintfA GetKeyboardLayout ReleaseDC OpenClipboard GetDC GetClipboardData

advapi32

GetUserNameW RegEnumKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW SetFileSecurityW RevertToSelf DuplicateTokenEx SetThreadToken LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegQueryValueExW RegOpenKeyExW RegCloseKey

crypt32

CryptUnprotectData CryptStringToBinaryA

bcrypt

BCryptGenRandom BCryptOpenAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptImportKeyPair BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptDeriveKeyPBKDF2 BCryptCloseAlgorithmProvider

shell32

SHGetFolderPathW

gdi32

GetDIBits DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt SelectObject

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpReadData WinHttpAddRequestHeaders WinHttpOpen WinHttpCloseHandle

shlwapi

PathMatchSpecW

wlanapi

WlanFreeMemory WlanGetProfile WlanEnumInterfaces WlanCloseHandle WlanOpenHandle WlanGetProfileList

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

SysFreeString SysAllocStringByteLen SysStringByteLen

ncrypt

NCryptDecrypt NCryptOpenKey NCryptOpenStorageProvider NCryptFreeObject

vcruntime140

strchr memmove memcmp memchr wcsstr memcpy memset __C_specific_handler strrchr

api-ms-win-crt-heap-l1-1-0

_msize malloc realloc free

api-ms-win-crt-string-l1-1-0

strlen strcspn strcmp strspn strncmp

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

fabs

Name

.text

Size

600KB

Virtual Size

600KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

441KB

Virtual Size

444KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

15KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.fcfg

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_bc4ca81a15e775b829f7d6ce7c8f6513_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

kernel32

user32

advapi32

crypt32

bcrypt

shell32

gdi32

winhttp

shlwapi

wlanapi

ole32

oleaut32

ncrypt

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

generic