2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 1.2MB
Sample260910-vbge7sek4y
SHA256 f5ab8367176a6c28df9263a090d461781d48e2a0a1bef191c41d0a7cafc2ab15
MD5 543f390f8a711c481fbf0d0099736eba
SHA1 59e07e6aa0e6b87e9fd79f9293dec9061b30f764
SHA512 51a13bd72eddf3d44e4356b5601efe6a2f6e90e27f35ef10afe5d589e0caa2f18bfe25d756237f94c390e527cd4484ef4e56242e258ebca7e7663dd8c11d95fe
SSDEEP 24576:ih09rHVGAxUqVpHi/oz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iiPGAHVpHFzLNiXicJFFRGNzj3
TLSH
T12845D056B3D002F9E0B7D13ACA568A65FBB2B8094720A7C703E456562F277E14F3E316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 1.2MB

2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 3dd526e6d104ef6b8ef2d7ab23d69c4d
SHA256 f5ab8367176a6c28df9263a090d461781d48e2a0a1bef191c41d0a7cafc2ab15
MD5 543f390f8a711c481fbf0d0099736eba
SHA1 59e07e6aa0e6b87e9fd79f9293dec9061b30f764
SHA512 51a13bd72eddf3d44e4356b5601efe6a2f6e90e27f35ef10afe5d589e0caa2f18bfe25d756237f94c390e527cd4484ef4e56242e258ebca7e7663dd8c11d95fe
SSDEEP 24576:ih09rHVGAxUqVpHi/oz/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:iiPGAHVpHFzLNiXicJFFRGNzj3
TLSH
T12845D056B3D002F9E0B7D13ACA568A65FBB2B8094720A7C703E456562F277E14F3E316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

79172

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\constructicon\builds\gfx\three\25.10\drivers\2d\dal\eeu\cmake_bridge\wNow64a\cmake_build\build\service\Release\atiesrxx.pdb

advapi32

CreateProcessAsUserA OpenThreadToken AdjustTokenPrivileges ImpersonateSelf LookupPrivilegeValueA CloseServiceHandle CreateServiceA DeleteService OpenSCManagerA OpenServiceA RegisterServiceCtrlHandlerExA SetServiceStatus StartServiceCtrlDispatcherA OpenProcessToken EventRegister EventUnregister EventWriteTransfer ImpersonateLoggedOnUser InitializeSecurityDescriptor RevertToSelf SetSecurityDescriptorDacl RegCloseKey RegOpenCurrentUser RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegOpenKeyExA RegSetValueExA RegSetValueExW RegGetValueA RegGetValueW RegEnumValueA SetEntriesInAclW FreeSid AllocateAndInitializeSid RegNotifyChangeKeyValue

wtsapi32

WTSFreeMemory WTSQuerySessionInformationA WTSEnumerateProcessesA WTSQueryUserToken

psapi

EnumProcessModules GetModuleInformation GetModuleBaseNameA

userenv

LoadUserProfileA UnloadUserProfile

powrprof

PowerReadDCValueIndex PowerEnumerate PowerReadACValueIndex PowerWriteACValueIndex PowerWriteDCValueIndex PowerGetActiveScheme PowerSetActiveScheme PowerSettingAccessCheck

setupapi

SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList CM_Reenumerate_DevNode CM_Locate_DevNodeA SetupDiSetClassInstallParamsA SetupDiGetHwProfileList SetupDiCallClassInstaller CM_Get_DevNode_Status CM_Get_Device_ID_ExA SetupDiGetDeviceRegistryPropertyA SetupDiGetClassDevsA

dwmapi

DwmIsCompositionEnabled

shlwapi

StrStrIA

kernel32

ReadConsoleW ReadFile SetFilePointerEx GetFileSizeEx SetConsoleCtrlHandler GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW OutputDebugStringW WideCharToMultiByte GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect RtlCaptureStackBackTrace GetCurrentProcess FreeLibrary GetModuleHandleA GetProcAddress SetDefaultDllDirectories lstrcmpiA HeapSize WaitForSingleObject GetSystemDirectoryA MapViewOfFile UnmapViewOfFile CreateFileMappingA WTSGetActiveConsoleSessionId GetLastError GetCurrentThread GetModuleFileNameA GetFirmwareEnvironmentVariableA SetFirmwareEnvironmentVariableA FreeResource LoadResource LockResource FindResourceExA GetSystemDefaultLangID GetEnvironmentVariableA GetFileAttributesA CloseHandle TerminateProcess CreateProcessA OpenProcess QueryFullProcessImageNameA CreateToolhelp32Snapshot Process32First Process32Next SetEvent ResetEvent CreateEventA OpenEventA WaitForMultipleObjects LoadLibraryExA LoadLibraryA OutputDebugStringA GetLocalTime ReleaseMutex CreateMutexA OpenMutexA CreateThread SetThreadPriority TerminateThread LocalFree Sleep VerSetConditionMask DeleteFileA FindClose FindFirstFileA FindNextFileA RemoveDirectoryA GetWindowsDirectoryA VerifyVersionInfoW GetCurrentProcessId GetPackageFamilyName ExpandEnvironmentStringsA CreateFileA QueryPerformanceCounter QueryPerformanceFrequency DeviceIoControl LocalAlloc InitializeCriticalSectionEx IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc GetTempPathW GetFileType HeapAlloc HeapFree GetCommandLineW GetCommandLineA HeapReAlloc WriteConsoleW SetEndOfFile CreateFileW RegisterApplicationRecoveryCallback GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW RtlUnwind

user32

SetSysColors SystemParametersInfoA RegisterDeviceNotificationA UnregisterDeviceNotification RegisterPowerSettingNotification UnregisterPowerSettingNotification PostMessageA PostThreadMessageA GetSysColor RedrawWindow

Name

.text

Size

473KB

Virtual Size

473KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

113KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

memcpy_

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_c

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_guard_d

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_543f390f8a711c481fbf0d0099736eba_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

advapi32

wtsapi32

psapi

userenv

powrprof

setupapi

dwmapi

shlwapi

kernel32

user32

generic