2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.7MB
Sample260915-wrc86ayzhv
SHA256 96645509032398aef3d0dafff6767c7f3519c96df5c712f3857391ba649b519a
MD5 54c0b2771ec4212d30dbc0c84ce6abcb
SHA1 4b4cddef4c5becebf271e72374615a1510ae52f5
SHA512 d3668c89a3538bea7e2724e1fa15b80c0da956d6dca032cee73984de44d6df120fbdc2029d06575f661e87b328000911bac5996b84fa52a1a3e5e4145767f9e7
SSDEEP 24576:QLBMAf0XHKDunAQLXimunrrhX4TOet62R6yz/TwSfVcYG3K/cJHlnFR+IGNe8j3w:QtYaDYzymsNiOEfLNiXicJFFRGNzj3
TLSH
T10185BE8997A401F8D5F7E275C8266903DA72FCA9077056DB0290338E7F3B6A1CE79712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.7MB

2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 9399451cc3dda72bb472f2dddbaebaec
SHA256 96645509032398aef3d0dafff6767c7f3519c96df5c712f3857391ba649b519a
MD5 54c0b2771ec4212d30dbc0c84ce6abcb
SHA1 4b4cddef4c5becebf271e72374615a1510ae52f5
SHA512 d3668c89a3538bea7e2724e1fa15b80c0da956d6dca032cee73984de44d6df120fbdc2029d06575f661e87b328000911bac5996b84fa52a1a3e5e4145767f9e7
SSDEEP 24576:QLBMAf0XHKDunAQLXimunrrhX4TOet62R6yz/TwSfVcYG3K/cJHlnFR+IGNe8j3w:QtYaDYzymsNiOEfLNiXicJFFRGNzj3
TLSH
T10185BE8997A401F8D5F7E275C8266903DA72FCA9077056DB0290338E7F3B6A1CE79712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

566768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\jenkins\workspace\Client.den\Client\Windows\release\Bin\x64\Release\Installer.pdb

psapi

GetModuleBaseNameW EnumProcesses GetProcessImageFileNameW GetModuleFileNameExW EnumProcessModules

shlwapi

PathAddBackslashW PathAppendW PathFileExistsW PathIsNetworkPathW PathIsRelativeW PathRemoveBackslashW PathUnquoteSpacesW StrCmpNIW PathIsURLW PathAppendA ord2 PathIsUNCW UrlUnescapeW PathFileExistsA StrStrIA PathRemoveFileSpecW PathIsPrefixW

oleacc

AccessibleObjectFromWindow LresultFromObject

kernel32

OpenProcess IsBadReadPtr IsBadWritePtr GetTickCount FindFirstFileW HeapFree FindNextFileW WriteFile ExpandEnvironmentStringsW DeviceIoControl RemoveDirectoryW K32GetModuleFileNameExW SetFilePointer GetTempPathW CreateToolhelp32Snapshot Process32NextW CreateFileA Process32FirstW LoadLibraryW HeapAlloc MoveFileExW VerSetConditionMask GetProcessHeap VerifyVersionInfoW GetTempFileNameW MoveFileW LoadLibraryExW CopyFileW Sleep OutputDebugStringW SetDllDirectoryW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection LocalFree CreateMutexW OpenMutexW ReadFile TerminateProcess QueryFullProcessImageNameW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetSystemTimeAsFileTime GetConsoleMode ReadConsoleW GetConsoleOutputCP SetFilePointerEx GetFileType GetFullPathNameW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle GetStartupInfoW FlsAlloc FlsGetValue GetModuleFileNameW FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetFileSizeEx GetTimeZoneInformation SetStdHandle SetEndOfFile HeapReAlloc GetDriveTypeW ExitProcess IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW WriteConsoleW GetCurrentDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW QueryPerformanceCounter InitializeSListHead FormatMessageA EncodePointer LCMapStringEx RtlUnwindEx RtlUnwind RtlPcToFileHeader GlobalAlloc GlobalFree GetFinalPathNameByHandleW GetModuleFileNameA GetTempPathA GetFileAttributesA GetBinaryTypeA ProcessIdToSessionId MoveFileExA WritePrivateProfileStringA GetPrivateProfileIntA GetPrivateProfileStringA GetProcessTimes VirtualQuery GetWindowsDirectoryW QueryDosDeviceW GetEnvironmentVariableW LoadLibraryA GetSystemDirectoryA LoadLibraryExA ExpandEnvironmentStringsA TlsFree TlsAlloc DosDateTimeToFileTime TlsGetValue FreeLibrary GetTickCount64 LocalFileTimeToFileTime SetFileAttributesW SetFileTime SetLastError TlsSetValue CreateDirectoryW MulDiv GetSystemDirectoryW MapViewOfFile CreateFileMappingW GetFileSize UnmapViewOfFile CreateFileW CreateDirectoryA WideCharToMultiByte GetWindowsDirectoryA DeleteFileW MultiByteToWideChar GetModuleHandleA GetVersionExW FindClose OutputDebugStringA IsBadStringPtrW GetCurrentProcess FindFirstFileA lstrlenW GetCurrentProcessId GetLocalTime GetCurrentThreadId GetModuleHandleW CreateProcessW DeleteCriticalSection GetProcAddress DecodePointer RaiseException CloseHandle GetFileAttributesW WaitForSingleObject InitializeCriticalSectionEx GetLastError FindFirstFileExW GetCommandLineA GetCommandLineW InitOnceBeginInitialize InitOnceComplete GetFileAttributesExW GetFileInformationByHandleEx GetSystemInfo FlsSetValue K32GetProcessImageFileNameW

user32

OffsetRect GetWindowTextLengthW NotifyWinEvent GetWindowLongPtrW IsWindow ClientToScreen PtInRect GetAncestor GetWindowTextW SendMessageW UnregisterClassW LoadStringW FillRect EnumWindows SendMessageTimeoutW GetSystemMetrics DestroyWindow InflateRect GetWindowThreadProcessId SetRect GetSysColor CharNextW IntersectRect CopyRect SetCursor LoadCursorW ShowWindow IsWindowVisible LoadBitmapW EndPaint BeginPaint ReleaseDC InvalidateRect ReleaseCapture SystemParametersInfoW GetClientRect SetCapture GetUpdateRect SetFocus SetWindowPos DispatchMessageW GetMessageW FindWindowW EnableMenuItem PostQuitMessage MessageBoxW PostMessageW GetMenuState GetSystemMenu LoadIconW SetTimer RegisterClassExW CreateWindowExW GetDC GetFocus GetWindowRect GetKeyState DrawEdge DrawTextW IsRectEmpty TranslateMessage DefWindowProcW

gdi32

GetStockObject BitBlt TextOutW GetTextExtentPoint32W LineTo CreatePen Rectangle GetObjectW MoveToEx CreateSolidBrush GetTextMetricsW CreateFontIndirectW RoundRect SelectObject GetClipBox CreateRectRgnIndirect SetTextColor SetBkMode ExtSelectClipRgn CreateCompatibleBitmap SaveDC CreateCompatibleDC RestoreDC SetBkColor ExtTextOutW SelectClipRgn DeleteDC GetObjectType DeleteObject

advapi32

CheckTokenMembership GetUserNameW RegUnLoadKeyW RegLoadKeyW ConvertSidToStringSidW OpenProcessToken GetTokenInformation RegEnumValueW CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext RegDeleteKeyW RegEnumKeyExW RegCreateKeyExW AllocateAndInitializeSid FreeSid RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegCreateKeyA RegCloseKey RegQueryValueExA RegSetValueExA RegOpenKeyExA RegDeleteValueA DuplicateTokenEx

shell32

ShellExecuteExW SHGetSpecialFolderPathA SHGetSpecialFolderPathW SHChangeNotify SHFileOperationW ShellExecuteW SHGetFolderPathA SHParseDisplayName SHOpenFolderAndSelectItems SHGetFolderPathW SHGetKnownFolderPath

ole32

CoUninitialize CoTaskMemAlloc CoCreateInstance CoInitialize CoTaskMemFree CoInitializeEx CoSetProxyBlanket CoInitializeSecurity PropVariantClear

oleaut32

VarBstrCat VariantClear VariantChangeType SysAllocStringLen SysFreeString VariantInit SysAllocString SysStringLen

Name

.text

Size

651KB

Virtual Size

651KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

197KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

246KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-15_54c0b2771ec4212d30dbc0c84ce6abcb_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

psapi

shlwapi

oleacc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic