2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

Resubmissions

10/09/2026, 07:14

260910-h2w75aga4810

10/09/2026, 06:04

260910-gsxlvsyhph10

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar
Size 1.4MB
Sample260910-h2w75aga48
SHA256 d03155b9b6f56dc0dde5df5854a635b8d1f064d8ccd82905a89a128c74cad9d3
MD5 4673725f1adab911f8089538b2a4e694
SHA1 6049cc237b5ba5bbcdfd2cc5adf5604a1dbea280
SHA512 e92a94845b015b0847db9a637a80bee20f27729d748e2a20df0f0b45b10f71881f7777670710d3f3835e932f9bb4f4dab1416456161a8f001b7ff8eb9cad9979
SSDEEP 24576:c09W8T+KfIGI9pZcTy045HbJiGGC5SYCTyxknw4FYnshx8OfVe247:c09W8jG9pyW04ZXzx4x8EVep
TLSH
T15765AD2DE6A801AAE06A9136EC554306E7B37F15137186CB33A0766A1F775E0CF3EE11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

.exe 1.4MB

2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 0952fc8422e9df4737b41086c55c43d8
SHA256 d03155b9b6f56dc0dde5df5854a635b8d1f064d8ccd82905a89a128c74cad9d3
MD5 4673725f1adab911f8089538b2a4e694
SHA1 6049cc237b5ba5bbcdfd2cc5adf5604a1dbea280
SHA512 e92a94845b015b0847db9a637a80bee20f27729d748e2a20df0f0b45b10f71881f7777670710d3f3835e932f9bb4f4dab1416456161a8f001b7ff8eb9cad9979
SSDEEP 24576:c09W8T+KfIGI9pZcTy045HbJiGGC5SYCTyxknw4FYnshx8OfVe247:c09W8jG9pyW04ZXzx4x8EVep
TLSH
T15765AD2DE6A801AAE06A9136EC554306E7B37F15137186CB33A0766A1F775E0CF3EE11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

234640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

FCAT_DT_Capture_x64.pdb

kernel32

GetModuleFileNameA SetLastError GetFullPathNameW GetModuleFileNameW LocalAlloc CreateFileW GetFileAttributesW GetSystemDirectoryW GetLastError CloseHandle GetProcAddress LocalFree VerSetConditionMask CreateProcessW GetModuleHandleW FreeLibrary VerifyVersionInfoW LoadLibraryExW CreateDirectoryW SetConsoleCtrlHandler EnterCriticalSection GetCommandLineW SetConsoleTitleA GetCurrentProcess RegisterWaitForSingleObject UnregisterWait OutputDebugStringA LeaveCriticalSection InitializeCriticalSection WaitForSingleObject GetCurrentThreadId FindFirstChangeNotificationW CreateEventW Sleep AttachConsole OutputDebugStringW SetEvent FindCloseChangeNotification QueryPerformanceFrequency ResetEvent GetLocalTime FindNextChangeNotification DeleteCriticalSection GetCurrentProcessId lstrcmpiW QueryPerformanceCounter AllocConsole HeapFree SetDefaultDllDirectories CreateMutexW GetCurrentDirectoryA UnmapViewOfFile SetProcessMitigationPolicy CreateThread HeapAlloc CreateFileMappingA GetProcessHeap lstrcpyW OpenFileMappingA MapViewOfFile MulDiv WritePrivateProfileStringW GetPrivateProfileIntW LoadLibraryExA GetPrivateProfileStringW WaitForMultipleObjects OpenProcess CopyFileW FormatMessageA CreateEventA SetEndOfFile WriteConsoleW HeapSize GetTimeZoneInformation HeapReAlloc SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadFile ReadConsoleW PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleMode SetFilePointerEx RaiseException GetSystemInfo VirtualProtect VirtualQuery RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead MultiByteToWideChar GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI MoveFileExW GetFileInformationByHandleEx WideCharToMultiByte GetStringTypeW TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo RtlUnwindEx RtlPcToFileHeader InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetConsoleCP ExitProcess GetStdHandle WriteFile GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx RtlUnwind

ole32

CoTaskMemFree

shlwapi

PathFileExistsW

bcrypt

BCryptImportKeyPair BCryptVerifySignature BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyKey

Name

.text

Size

569KB

Virtual Size

569KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_4673725f1adab911f8089538b2a4e694_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

kernel32

ole32

shlwapi

bcrypt

generic