2026-09-08_07c3d670779db075f25f3ca94d550428_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_07c3d670779db075f25f3ca94d550428_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.9MB
Sample260910-jlvj2azepe
SHA256 02da484d5b7ddb616800d9432432445a22199059316c0e06a8b1c9aab5c3a155
MD5 07c3d670779db075f25f3ca94d550428
SHA1 b0b1fe3167b840d0740241dbd66fe54be7b15c58
SHA512 def61bcf178b86417abefc84c3badc6bc0c663457c59cd556b0e84468b7e0fd85b2a37ef5a59a4dcfc738f687fb76aa555eefb564781220cfc3ce8d5c2db7604
SSDEEP 24576:0m/6WJCMyMvdgKoeyxknw4FYnshx8OfVe247:1CIvlUx4x8EVep
TLSH
T1D995D0A5B29913F9D07BD17C891A8901F671B85547A08BEF43E086376E276E25F3F302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_07c3d670779db075f25f3ca94d550428_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-09-08_07c3d670779db075f25f3ca94d550428_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.9MB

2026-09-08_07c3d670779db075f25f3ca94d550428_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH ad67fc0e6ddfa602094d9c8428e1fbc9
SHA256 02da484d5b7ddb616800d9432432445a22199059316c0e06a8b1c9aab5c3a155
MD5 07c3d670779db075f25f3ca94d550428
SHA1 b0b1fe3167b840d0740241dbd66fe54be7b15c58
SHA512 def61bcf178b86417abefc84c3badc6bc0c663457c59cd556b0e84468b7e0fd85b2a37ef5a59a4dcfc738f687fb76aa555eefb564781220cfc3ce8d5c2db7604
SSDEEP 24576:0m/6WJCMyMvdgKoeyxknw4FYnshx8OfVe247:1CIvlUx4x8EVep
TLSH
T1D995D0A5B29913F9D07BD17C891A8901F671B85547A08BEF43E086376E276E25F3F302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

226688

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Jenkins\workspace\AsIO_Driver\AsIO3\x64\Release\InstDrv.pdb

kernel32

Wow64RevertWow64FsRedirection GetFileAttributesA CloseHandle MoveFileExW Sleep CopyFileW GetTempFileNameW SetEndOfFile WriteConsoleW HeapSize GetPrivateProfileStringW WaitForSingleObject GetTempPathW GetModuleFileNameW GetPrivateProfileIntW Wow64DisableWow64FsRedirection WideCharToMultiByte GetCurrentProcessId GetLastError GetConsoleMode GetCurrentThreadId GetDynamicTimeZoneInformation WriteFile WriteConsoleA GetStdHandle SetConsoleTextAttribute CreateProcessW GetConsoleScreenBufferInfo CreateFileW ReadConsoleW ReadFile GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW MultiByteToWideChar InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EncodePointer DecodePointer GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetTimeZoneInformation GetLocalTime CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP DeleteFileW GetFileSizeEx SetFilePointerEx CreateDirectoryW SetStdHandle HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW

user32

wsprintfW

advapi32

ControlService RegCloseKey RegDeleteKeyExW QueryServiceStatus RegCreateKeyExW RegSetValueExW StartServiceW RegOpenKeyExW ChangeServiceConfigW RegDeleteValueW RegQueryValueExW CreateServiceW CloseServiceHandle OpenSCManagerW DeleteService QueryServiceConfigW OpenServiceW

shell32

SHGetFolderPathAndSubDirW SHGetFolderPathW SHGetFolderPathA

shlwapi

PathFileExistsW

Name

.text

Size

379KB

Virtual Size

379KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

125KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_07c3d670779db075f25f3ca94d550428_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

advapi32

shell32

shlwapi

generic