2026-09-27_0b7da79b35475bbe4800c2aaaaed1046_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

General

Target
2026-09-27_0b7da79b35475bbe4800c2aaaaed1046_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 18.5MB
Sample260927-k1tfystemc
SHA256 2ddb463c10ba5bd83ebd8b2610cc6bb4289ba63d75f959e2c4b95d2a41269528
MD5 0b7da79b35475bbe4800c2aaaaed1046
SHA1 f1726d28ce194de27107160546042fb7016e9b79
SHA512 7f5a09a6c177c166157bc608355f62963205d01bbf559dc1fba7c3bc627affcb46de3e1fb5f7602d97d79d94d4c70d0144d7d10d414c3d426facf9081b67a433
SSDEEP 393216:1U5SGjDnZM9w4VG0BZq937fniqVRdWHYVQzS2W6oUsDaAdfEd9:1TQDZGbJBst1LY4ujW6VMTd
TLSH
T1EE17333A98121A10E1E380302CF70365E77959B2AF94F67D41A19B3E1E7FD986EE453C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-27_0b7da79b35475bbe4800c2aaaaed1046_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-09-27_0b7da79b35475bbe4800c2aaaaed1046_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 18.5MB

2026-09-27_0b7da79b35475bbe4800c2aaaaed1046_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH c298ef644e374298f3f3578a36acbec8
SHA256 2ddb463c10ba5bd83ebd8b2610cc6bb4289ba63d75f959e2c4b95d2a41269528
MD5 0b7da79b35475bbe4800c2aaaaed1046
SHA1 f1726d28ce194de27107160546042fb7016e9b79
SHA512 7f5a09a6c177c166157bc608355f62963205d01bbf559dc1fba7c3bc627affcb46de3e1fb5f7602d97d79d94d4c70d0144d7d10d414c3d426facf9081b67a433
SSDEEP 393216:1U5SGjDnZM9w4VG0BZq937fniqVRdWHYVQzS2W6oUsDaAdfEd9:1TQDZGbJBst1LY4ujW6VMTd
TLSH
T1EE17333A98121A10E1E380302CF70365E77959B2AF94F67D41A19B3E1E7FD986EE453C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

24816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleHandleA GetProcAddress LoadLibraryA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW WriteConsoleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode CloseHandle CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-27_0b7da79b35475bbe4800c2aaaaed1046_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

kernel32

generic