2026-09-23_d4e0b9f58f6e905353c2919532ed2e90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-23_d4e0b9f58f6e905353c2919532ed2e90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.5MB
Sample260924-bhz2caaf77
SHA256 4807eb3245b3119b6eede4aa5a097f1b2eb27bfc92d67675c1d62e1b96ea1e2f
MD5 d4e0b9f58f6e905353c2919532ed2e90
SHA1 b0820cd056eec21949525b911f47a81e161e7d6d
SHA512 1e9a261e039638b1818477ddbd93b1b88227216b5b47d59eca0d6c644d096e6c79163deff3e1bf03579fb3e207e0ed2039a42c3d5777aae24dad862a5832a792
SSDEEP 24576:ebqz8d97iSC7Cc37WfYyzpJu3TpL/xgo1yxknw4FYnshx8OfVe247:eU47bCv37c7vugJx4x8EVep
TLSH
T1AC65BF1A67AC42F5D1FAE17889961107E7B27C165732C3CF02B1665D2F37AE08E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-23_d4e0b9f58f6e905353c2919532ed2e90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-09-23_d4e0b9f58f6e905353c2919532ed2e90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.5MB

2026-09-23_d4e0b9f58f6e905353c2919532ed2e90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 02dabb47817373fe16d92db33afffdd5
SHA256 4807eb3245b3119b6eede4aa5a097f1b2eb27bfc92d67675c1d62e1b96ea1e2f
MD5 d4e0b9f58f6e905353c2919532ed2e90
SHA1 b0820cd056eec21949525b911f47a81e161e7d6d
SHA512 1e9a261e039638b1818477ddbd93b1b88227216b5b47d59eca0d6c644d096e6c79163deff3e1bf03579fb3e207e0ed2039a42c3d5777aae24dad862a5832a792
SSDEEP 24576:ebqz8d97iSC7Cc37WfYyzpJu3TpL/xgo1yxknw4FYnshx8OfVe247:eU47bCv37c7vugJx4x8EVep
TLSH
T1AC65BF1A67AC42F5D1FAE17889961107E7B27C165732C3CF02B1665D2F37AE08E3A721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

441184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\dbs\sh\odct\0211_070530\client\onedrive\Product\OD4\exe\obj\amd64\OneDrive.App.pdb

kernel32

GetVolumePathNameW ReadFile RemoveDirectoryW SetFileAttributesW SetFileInformationByHandle SetFilePointer GetCompressedFileSizeW FindFirstFileNameW IsDebuggerPresent SetHandleInformation CreatePipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus DeviceIoControl OpenMutexW IsWow64Process LoadLibraryExW GlobalAlloc GlobalUnlock GlobalLock GlobalFree ReadDirectoryChangesW CreateSymbolicLinkW CompareStringOrdinal CreateToolhelp32Snapshot Process32FirstW Process32NextW GetProcessIoCounters GetPrivateProfileStringW WritePrivateProfileStringW CopyFileW MoveFileExW ReplaceFileW GetComputerNameW RegisterApplicationRestart GetFileInformationByHandleEx OpenFileById DecodePointer GetModuleHandleW GetDllDirectoryW WriteConsoleW ReadConsoleW SetEndOfFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetFinalPathNameByHandleW GetCommandLineA FindNextFileW FindFirstFileExW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetTimeFormatW GetDateFormatW GetFileType GetFileSizeEx GetFileSize GetFileInformationByHandle GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindVolumeClose FindNextVolumeW FindFirstVolumeW CreateFileW CreateDirectoryW SetThreadInformation GetSystemTimes SetProcessShutdownParameters CreateProcessW GetExitCodeProcess GetProcessTimes ExpandEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW WaitForMultipleObjects Sleep CreateEventW GetLongPathNameW SetLastError VerifyVersionInfoW GetProductInfo VerSetConditionMask DeleteCriticalSection InitializeCriticalSectionEx LCMapStringW WideCharToMultiByte MultiByteToWideChar K32GetModuleFileNameExW GetUserDefaultLCID GetUserGeoID LCIDToLocaleName SystemTimeToFileTime MoveFileW LocalFree LocalAlloc GetModuleFileNameW GetVersionExW GetSystemTimeAsFileTime GetSystemTime OpenProcess TerminateProcess GetCurrentProcessId GetCurrentProcess WaitForSingleObject GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc GetProcAddress FindFirstFileW FindClose DeleteFileW CloseHandle ReleaseMutex FlsFree FlsSetValue FlsGetValue FlsAlloc ExitProcess WriteFile GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread VirtualProtect TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx RaiseException OutputDebugStringW GetStartupInfoW InitializeSListHead GetCurrentThreadId IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind FreeLibrary LoadLibraryW SetDllDirectoryW GetLastError CreateMutexW GetEnvironmentStringsW RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetLocaleInfoEx LeaveCriticalSection EnterCriticalSection GetStringTypeW QueryPerformanceCounter

user32

FindWindowW PostMessageW RegisterClassW CreateWindowExW DefWindowProcW EnumWindows GetClassNameW GetWindowThreadProcessId SystemParametersInfoW SendMessageTimeoutW DestroyWindow SetClipboardData RegisterClipboardFormatW CloseClipboard GetMessageW TranslateMessage DispatchMessageW RegisterPowerSettingNotification UnregisterPowerSettingNotification RegisterSuspendResumeNotification UnregisterSuspendResumeNotification ShowWindow OpenClipboard

advapi32

GetNamedSecurityInfoW AdjustTokenPrivileges CreateProcessWithTokenW GetUserNameW SetFileSecurityW ConvertSidToStringSidW SetNamedSecurityInfoW SetEntriesInAclW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegDeleteTreeW RegUnLoadKeyW RegNotifyChangeKeyValue RegLoadKeyW RegEnumKeyW RegDeleteKeyExW RegCreateKeyTransactedW GetAclInformation FreeSid DuplicateTokenEx CreateWellKnownSid AllocateAndInitializeSid CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegGetValueW RegSetKeyValueW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW GetTokenInformation OpenProcessToken

shell32

SHGetFolderPathAndSubDirW SHSetKnownFolderPath ord526 SHFileOperationW SHGetSpecialFolderPathW SHGetKnownFolderPath SHChangeNotify SHParseDisplayName ShellExecuteW SHCreateDirectoryExW ShellExecuteExW SHCreateItemFromParsingName SHGetPropertyStoreFromParsingName SHAssocEnumHandlers SHGetFolderPathW CommandLineToArgvW

ole32

CoCreateInstance StringFromGUID2 CoTaskMemFree CreateBindCtx StringFromCLSID CoCreateGuid CoUninitialize CoInitializeEx CoSetProxyBlanket CreateItemMoniker GetRunningObjectTable

oleaut32

LoadTypeLi LoadRegTypeLi GetRecordInfoFromTypeInfo

crypt32

CryptBinaryToStringW CryptStringToBinaryW CertFindExtension

rpcrt4

RpcBindingFree RpcBindingFromStringBindingW RpcBindingVectorFree RpcStringBindingComposeW RpcStringFreeW RpcServerInqBindings RpcServerRegisterIfEx RpcServerUnregisterIf RpcServerUseProtseqW RpcBindingSetAuthInfoExW RpcEpRegisterW RpcEpUnregister RpcServerInqCallAttributesW UuidCreate

secur32

GetUserNameExW

shlwapi

PathFileExistsW SHGetValueA SHGetValueW SHRegGetUSValueW PathIsDirectoryW PathIsPrefixW StrStrIW PathRemoveFileSpecW SHDeleteKeyW SHDeleteValueW SHSetValueW PathIsDirectoryEmptyW PathStripPathW SHCreateStreamOnFileW AssocQueryStringW SHRegGetBoolUSValueW SHRegGetPathW SHRegGetValueW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wininet

InternetCheckConnectionW

wtsapi32

WTSEnumerateSessionsW WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken

userenv

CreateEnvironmentBlock GetDefaultUserProfileDirectoryW

Name

.text

Size

606KB

Virtual Size

606KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_d4e0b9f58f6e905353c2919532ed2e90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

rpcrt4

secur32

shlwapi

version

wininet

wtsapi32

userenv

generic