2026-09-08_3ad00d003b9f868c7a9addce60cd1300_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

General

Target
2026-09-08_3ad00d003b9f868c7a9addce60cd1300_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 1.3MB
Sample260910-g5ralsstdx
SHA256 52ce006b51455ea99c012a2414746dcd1e3a01fb0661a13f87bf34d473497fd8
MD5 3ad00d003b9f868c7a9addce60cd1300
SHA1 41788eca4c3743c3d627a8ecbf4a099633460649
SHA512 c20aa77a4a95598c6b59604b7b0fcc11d0f44e3d27d37fb84b213a5e6a49cf3b1cc8e7ac47d0013a686d92622da767e642e2dd77ffc8688bfe8d7dc2e607b6c1
SSDEEP 6144:Frwqg1JnqRt7a+WcHQT6fs52j12mmNASo2IrT5Zm+COWaNsIeCPy+RXUbDX84o1Q:FrwZzqRt7a+R1j14Gn2IGxaZej7J50X
TLSH
T15D55C053268898D8CC1E8CB8A52302479BB1EC7CD879B24B9ED5BD4E4F375C06E396D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_3ad00d003b9f868c7a9addce60cd1300_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-09-08_3ad00d003b9f868c7a9addce60cd1300_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 1.3MB

2026-09-08_3ad00d003b9f868c7a9addce60cd1300_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 6efb5209a24006dce622eb3fb3f7fe46
SHA256 52ce006b51455ea99c012a2414746dcd1e3a01fb0661a13f87bf34d473497fd8
MD5 3ad00d003b9f868c7a9addce60cd1300
SHA1 41788eca4c3743c3d627a8ecbf4a099633460649
SHA512 c20aa77a4a95598c6b59604b7b0fcc11d0f44e3d27d37fb84b213a5e6a49cf3b1cc8e7ac47d0013a686d92622da767e642e2dd77ffc8688bfe8d7dc2e607b6c1
SSDEEP 6144:Frwqg1JnqRt7a+WcHQT6fs52j12mmNASo2IrT5Zm+COWaNsIeCPy+RXUbDX84o1Q:FrwZzqRt7a+R1j14Gn2IGxaZej7J50X
TLSH
T15D55C053268898D8CC1E8CB8A52302479BB1EC7CD879B24B9ED5BD4E4F375C06E396D1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\jenkins\workspace\KRLauncherPackage\source\.package\HomeBase\KRLauncherJumper\launcher.pdb

kernel32

GetStartupInfoW GetModuleFileNameW GetFileAttributesW GetLastError CloseHandle CreateProcessW WriteConsoleW CreateFileW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode

shell32

ShellExecuteExW

Name

.text

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

398KB

Virtual Size

397KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

776KB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_3ad00d003b9f868c7a9addce60cd1300_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

kernel32

shell32

generic