2026-09-30_a348903f7fa437a85cbe7fdfa8a6d71e_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_a348903f7fa437a85cbe7fdfa8a6d71e_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 2.4MB
Sample261001-krvmnafd42
SHA256 c444fcbf87f9eb050a46df2125edc71f78384535ac7a04f250a83af5f9ac2e92
MD5 a348903f7fa437a85cbe7fdfa8a6d71e
SHA1 a9c6bfd1b6cc308266780437a8226a202169eaab
SHA512 f9169adb958f0ef83ddac3e3942525f07917dfce572466b466f7a9a44fe679f74aec6a7a34948c2e9290110e5cb1cd9483f2897408293c136bc1b7fad8426c86
SSDEEP 49152:jkc4Vax+p7tkQPMcbwbQFsHvkS0BYiE1Q4GxubdNNVdb9IPK:j4VJ7tkQVbw8FscS0WiEa4GINT1G
TLSH
T138C51256AAD102F0D477913889864677F1B1F4241379FFCF06A88AA62F23BE54B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_a348903f7fa437a85cbe7fdfa8a6d71e_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-09-30_a348903f7fa437a85cbe7fdfa8a6d71e_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 2.4MB

2026-09-30_a348903f7fa437a85cbe7fdfa8a6d71e_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 2809a0b06626ae0927b92f7f4702c3bf
SHA256 c444fcbf87f9eb050a46df2125edc71f78384535ac7a04f250a83af5f9ac2e92
MD5 a348903f7fa437a85cbe7fdfa8a6d71e
SHA1 a9c6bfd1b6cc308266780437a8226a202169eaab
SHA512 f9169adb958f0ef83ddac3e3942525f07917dfce572466b466f7a9a44fe679f74aec6a7a34948c2e9290110e5cb1cd9483f2897408293c136bc1b7fad8426c86
SSDEEP 49152:jkc4Vax+p7tkQPMcbwbQFsHvkS0BYiE1Q4GxubdNNVdb9IPK:j4VJ7tkQVbw8FscS0WiEa4GINT1G
TLSH
T138C51256AAD102F0D477913889864677F1B1F4241379FFCF06A88AA62F23BE54B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

203040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ssh-agent.pdb

libcrypto

BN_bin2bn DSA_generate_parameters_ex DSA_SIG_free BN_dup RSA_generate_key_ex BN_set_flags RSA_public_decrypt RSA_new RSA_set0_crt_params RSA_free BN_free BN_set_word RSA_sign BN_div RSA_set0_factors RSA_get0_factors RSA_get0_crt_params RSA_set0_key BN_CTX_new BN_CTX_free EVP_sha384 EVP_md5 EVP_sha256 EVP_Digest DSA_generate_key EVP_sha1 DSA_get0_pqg EVP_sha512 EVP_CIPHER_CTX_key_length EVP_CIPHER_CTX_new EVP_aes_256_cbc DSA_set0_pqg DSA_SIG_new EVP_CipherInit EVP_aes_128_ctr DSA_new DSA_SIG_get0 DSA_set0_key DSA_do_verify BN_bn2bin EVP_aes_256_ctr DSA_get0_key DSA_do_sign DSA_free DSA_SIG_set0 EC_POINT_point2oct EVP_des_ede3_cbc EVP_aes_192_cbc EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_set_key_length EVP_aes_192_ctr EVP_Cipher EVP_aes_256_gcm EVP_aes_128_gcm EVP_CIPHER_CTX_free ECDSA_do_sign EC_POINT_cmp EC_KEY_set_private_key EC_KEY_generate_key ECDSA_SIG_get0 EC_KEY_set_public_key EC_KEY_free ECDSA_SIG_free ECDSA_SIG_set0 EC_KEY_set_asn1_flag ECDSA_do_verify EC_KEY_new_by_curve_name ECDSA_SIG_new RSA_blinding_on EC_GROUP_get_order BN_clear_free BN_value_one EC_METHOD_get_field_type EC_POINT_mul EC_POINT_get_affine_coordinates_GFp EC_KEY_set_group EC_POINT_is_at_infinity arc4random_buf RSA_get0_key EC_POINT_free EVP_aes_128_cbc EC_KEY_get0_public_key EC_GROUP_free EC_POINT_new EC_GROUP_cmp EC_GROUP_set_asn1_flag EC_GROUP_get_curve_name BN_new EC_KEY_get0_private_key EC_KEY_get0_group BN_cmp BN_sub explicit_bzero EC_GROUP_new_by_curve_name EC_GROUP_method_of BN_num_bits EC_KEY_METHOD_set_sign RSA_up_ref d2i_ECDSA_SIG EC_KEY_set_method RSA_meth_set_priv_enc EC_KEY_METHOD_get_sign RSA_meth_set1_name RSA_set_method RSA_meth_dup RSA_size RSA_get_default_method EC_POINT_oct2point EC_KEY_METHOD_new EC_KEY_up_ref EC_KEY_OpenSSL

kernel32

GetCommandLineW GetCommandLineA GetCurrentDirectoryW SetCurrentDirectoryW SetEnvironmentVariableW RtlPcToFileHeader RaiseException EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError RtlUnwindEx GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SetStdHandle LoadLibraryExW ReadConsoleOutputA SetConsoleCursorPosition GetConsoleWindow Beep FillConsoleOutputAttribute WriteConsoleOutputA ReadConsoleInputW SetConsoleCursorInfo SetConsoleWindowInfo GetConsoleCursorInfo ScrollConsoleScreenBufferA GetConsoleOutputCP SetConsoleScreenBufferSize SetConsoleTextAttribute FillConsoleOutputCharacterA CreateWaitableTimerA WriteConsoleW CancelSynchronousIo GetConsoleMode SetConsoleMode WaitForSingleObjectEx WaitForMultipleObjectsEx ExitProcess FindClose FindFirstFileExW FindNextFileW CreateThread ExitThread GetFinalPathNameByHandleW FreeLibraryAndExitThread QueueUserAPC VerifyVersionInfoW VerSetConditionMask ResetEvent SleepEx ReadFileEx CreateFileA SetConsoleCtrlHandler GetModuleFileNameW HeapFree HeapAlloc GetLastError FlsAlloc FlsGetValue FlsSetValue SetHandleInformation FlsFree CreateNamedPipeW WaitForMultipleObjects InitializeCriticalSectionEx GetNamedPipeClientProcessId VirtualProtect GetQueuedCompletionStatus OpenProcess CompareStringW LCMapStringW SetEvent CloseHandle GetCurrentProcessId CreateProcessW CreateEventA CreateIoCompletionPort ConnectNamedPipe ReadFile WriteFile CancelIoEx GetOverlappedResult HeapReAlloc GetStringTypeW LocalFree ReadConsoleW GetFileSizeEx GetFullPathNameW IsValidCodePage WriteFileEx GetCurrentProcess GetStdHandle TerminateProcess GetACP GetModuleHandleExW SetEndOfFile GetCurrentThreadId DuplicateHandle GetTickCount64 SetFilePointerEx GetFileType CreateNamedPipeA CancelIo OpenThread FlushFileBuffers MultiByteToWideChar WideCharToMultiByte GetExitCodeProcess GetOEMCP GetConsoleScreenBufferInfo GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW WaitForSingleObject CreateFileW GetProcessHeap HeapSize GetLocalTime GetProcAddress GetComputerNameW FreeLibrary GetDriveTypeW ExpandEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW

advapi32

ConvertSidToStringSidW GetSidIdentifierAuthority EventWrite EventRegister CopySid IsValidSecurityDescriptor GetLengthSid LookupAccountNameW CreateProcessAsUserW RegDeleteTreeA RevertToSelf RegCloseKey RegOpenCurrentUser RegCreateKeyExA RegDeleteKeyExA RegEnumKeyExW ImpersonateLoggedOnUser RegDeleteTreeW RegOpenKeyExA RegOpenKeyExW RegQueryValueExW CreateWellKnownSid RegCreateKeyExW IsWellKnownSid RegSetValueExW OpenProcessToken CheckTokenMembership DuplicateToken ConvertStringSecurityDescriptorToSecurityDescriptorW DuplicateTokenEx GetTokenInformation OpenSCManagerW SetServiceStatus RegisterServiceCtrlHandlerW StartServiceA StartServiceCtrlDispatcherW OpenServiceW LookupAccountSidW

crypt32

CryptUnprotectData CryptStringToBinaryA CryptProtectData CryptBinaryToStringA

ws2_32

socket getsockname WSAStartup WSARecv WSASend WSAGetOverlappedResult setsockopt WSAGetLastError WSASocketW closesocket WSADuplicateSocketW

user32

ShowWindow GetWindowPlacement

Name

.text

Size

320KB

Virtual Size

319KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

196KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_a348903f7fa437a85cbe7fdfa8a6d71e_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

libcrypto

kernel32

advapi32

crypt32

ws2_32

user32

generic