2026-09-16_ce37fe40f1e775f36c7a155ee29b628b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_ce37fe40f1e775f36c7a155ee29b628b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar
Size 398KB
Sample260916-vefcbaxw4l
SHA256 418f26b3c642bfafff09ec79ab9cce581f1f5703e19f9b21848236ea12bad57d
MD5 ce37fe40f1e775f36c7a155ee29b628b
SHA1 7d91a7f017e4aa33e2c31f08faadf38ab1a1b781
SHA512 cda80fa12b9c4ad73bf3d8a386384e1207b34a325da6814e881329caed924fb399cb1077e2b289effeb5401163838e2691effe4790cc9c6052353e4b2faaf560
SSDEEP 6144:TE8A/4g8plU3Q3pl+6kH9pyelpmVHIQEhusex7oDu1zds:TE8A/h3Q3CTpmWQE5e
TLSH
T182945A16B3E505F9E4B7E27889A35906F7B238590320EAEF03E0491A2F277D0667F751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_ce37fe40f1e775f36c7a155ee29b628b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-09-16_ce37fe40f1e775f36c7a155ee29b628b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

.exe 398KB

2026-09-16_ce37fe40f1e775f36c7a155ee29b628b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 35faa609503c2fa00428e5758f8ac1ae
SHA256 418f26b3c642bfafff09ec79ab9cce581f1f5703e19f9b21848236ea12bad57d
MD5 ce37fe40f1e775f36c7a155ee29b628b
SHA1 7d91a7f017e4aa33e2c31f08faadf38ab1a1b781
SHA512 cda80fa12b9c4ad73bf3d8a386384e1207b34a325da6814e881329caed924fb399cb1077e2b289effeb5401163838e2691effe4790cc9c6052353e4b2faaf560
SSDEEP 6144:TE8A/4g8plU3Q3pl+6kH9pyelpmVHIQEhusex7oDu1zds:TE8A/h3Q3CTpmWQE5e
TLSH
T182945A16B3E505F9E4B7E27889A35906F7B238590320EAEF03E0491A2F277D0667F751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30644

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\meow\Desktop\all src latest\fortnite injector\fortnite injector\x64\Release\injector.pdb

kernel32

GetLastError DeleteFileA DeleteFileW CloseHandle SetFileAttributesW RemoveDirectoryA CreateProcessA RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetFileAttributesW CreateFileW WaitForSingleObject GetTempPathW MoveFileExW WriteFile SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte RtlCaptureContext

user32

MessageBoxW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

SHCreateDirectoryExW

msvcp140

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z

wininet

InternetOpenW InternetReadFile InternetCloseHandle InternetOpenUrlA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate _CxxThrowException __std_exception_destroy memcpy __current_exception memset __C_specific_handler __current_exception_context __std_exception_copy memmove

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _exit __p___argv _initterm _cexit _initialize_narrow_environment _configure_narrow_argv _initterm_e _set_app_type _seh_filter_exe _c_exit _crt_atexit _initialize_onexit_table terminate exit abort _invoke_watson system _get_initial_narrow_environment __p___argc _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

fgetc __p__commode fclose fflush setvbuf fgetpos fputc fsetpos fread _fseeki64 _get_stream_buffer_pointers _set_fmode ungetc fwrite

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_ce37fe40f1e775f36c7a155ee29b628b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

kernel32

user32

advapi32

shell32

msvcp140

wininet

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic