2026-09-27_7631a4620fe395071d68b84da5381211_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-27_7631a4620fe395071d68b84da5381211_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 596KB
Sample260928-e2r2mawtg1
SHA256 c8a6ce85f858bf8b7cf7fba01a6ba991305db1e90f0134f13c1c17732c0727db
MD5 7631a4620fe395071d68b84da5381211
SHA1 d43793c34619d46f80b1f4573835ef33708859ee
SHA512 68aa0aa77f1ad2f630e0ce6d5501472a3d22639d81852e5d730b3bd853fbbb541df2c981e65dbaaad133950d96c79456e92cfaa8cd0f8dd9a7ca14e2c61f5c6c
SSDEEP 6144:FsBgKOIT0VsvJP3e+9XamK47JChUn/1o+RQk8ceJS1qZKt3XU17I3:FsBgu1vZnntVRH8dS1qZ8XU
TLSH
T19BD4BE12BA5A21ADD9E74878C51085A6EB73BC1D43659B9B17C03E6B7F363C25F3C220
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-27_7631a4620fe395071d68b84da5381211_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-09-27_7631a4620fe395071d68b84da5381211_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 596KB

2026-09-27_7631a4620fe395071d68b84da5381211_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 6517ce1ce6a69c4ae234c3a4e094de7c
SHA256 c8a6ce85f858bf8b7cf7fba01a6ba991305db1e90f0134f13c1c17732c0727db
MD5 7631a4620fe395071d68b84da5381211
SHA1 d43793c34619d46f80b1f4573835ef33708859ee
SHA512 68aa0aa77f1ad2f630e0ce6d5501472a3d22639d81852e5d730b3bd853fbbb541df2c981e65dbaaad133950d96c79456e92cfaa8cd0f8dd9a7ca14e2c61f5c6c
SSDEEP 6144:FsBgKOIT0VsvJP3e+9XamK47JChUn/1o+RQk8ceJS1qZKt3XU17I3:FsBgu1vZnntVRH8dS1qZ8XU
TLSH
T19BD4BE12BA5A21ADD9E74878C51085A6EB73BC1D43659B9B17C03E6B7F363C25F3C220
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

503808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryExA MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer GetDriveTypeW GetFullPathNameW SetEnvironmentVariableW GetCurrentDirectoryW GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize CloseHandle CreateFileW WriteConsoleW

tier0

Error ?DevWarning@@YAXPEBDZZ CommandLine_Tier0 CreateSimpleThread Plat_IsInDebugSession GetThreadedLoadLibraryFunc ThreadWaitForObjects ReleaseThreadHandle

Name

.text

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

221KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

52KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rcd7cb

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-27_7631a4620fe395071d68b84da5381211_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

kernel32

tier0

generic