2026-09-30_606c4f1c4b9f6fbce8fc8c51c5615836_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_606c4f1c4b9f6fbce8fc8c51c5615836_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.6MB
Sample261001-qq2bpsxfpe
SHA256 d0381b7bce0a9957b6de0a39ae74aeab743a6c57b6e949b5f41d409dbd1bdbfa
MD5 606c4f1c4b9f6fbce8fc8c51c5615836
SHA1 2a607d36b93df240ecce1cbfdd7d5cd3872d84ec
SHA512 7bccfd615c84d47c82c337e91841f5b9f47ee7ffad4a884390562c68656dc07333f4b566806016a38ce2946e16b20a51cb303bcbd31f197c60c58e16da8385c7
SSDEEP 24576:wHm+hLA3BVrYRd/busqjnhMgeiCl7G0nehbGZpbD:jWA3jUFuDmg27RnWGj
TLSH
T1C275D006E3F905F8E0A7D1798A778901E6767C4507309BDF13A0957A6E336E09E3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_606c4f1c4b9f6fbce8fc8c51c5615836_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-09-30_606c4f1c4b9f6fbce8fc8c51c5615836_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.6MB

2026-09-30_606c4f1c4b9f6fbce8fc8c51c5615836_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 86328e48023f463231ae1064c95703f7
SHA256 d0381b7bce0a9957b6de0a39ae74aeab743a6c57b6e949b5f41d409dbd1bdbfa
MD5 606c4f1c4b9f6fbce8fc8c51c5615836
SHA1 2a607d36b93df240ecce1cbfdd7d5cd3872d84ec
SHA512 7bccfd615c84d47c82c337e91841f5b9f47ee7ffad4a884390562c68656dc07333f4b566806016a38ce2946e16b20a51cb303bcbd31f197c60c58e16da8385c7
SSDEEP 24576:wHm+hLA3BVrYRd/busqjnhMgeiCl7G0nehbGZpbD:jWA3jUFuDmg27RnWGj
TLSH
T1C275D006E3F905F8E0A7D1798A778901E6767C4507309BDF13A0957A6E336E09E3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

175152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\sjc2-jnkns11\workspace\apo_4x_service\x64\Release\DtsApo4Service.pdb

kernel32

ResetEvent SubmitThreadpoolWork GetProcAddress WideCharToMultiByte GetCPInfo DeleteCriticalSection CloseHandle GetModuleHandleW Process32FirstW DeleteTimerQueueTimer FreeEnvironmentStringsW CreateThreadpoolWork SetEnvironmentVariableW HeapFree SetEvent OutputDebugStringW HeapSize Process32NextW HeapReAlloc HeapAlloc GetLastError GetProcessHeap SetStdHandle Sleep GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose MultiByteToWideChar CreatePipe CreateEventW SetFilePointerEx GetFileSizeEx CreateToolhelp32Snapshot InitializeCriticalSectionEx LocalFree GetStringTypeW LCMapStringW WaitForMultipleObjects FlushFileBuffers GetConsoleOutputCP OutputDebugStringA WriteFile GetConsoleMode GetModuleFileNameW ReadConsoleW CreateTimerQueueTimer GetEnvironmentStringsW CompareStringW ReadFile GetCommandLineW GetCommandLineA ExitProcess WriteConsoleW GetFileType GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind LoadLibraryExW FreeLibrary TlsFree CreateFileW IsDebuggerPresent RaiseException EnterCriticalSection LeaveCriticalSection QueryPerformanceCounter QueryPerformanceFrequency InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue

advapi32

RegNotifyChangeKeyValue ChangeServiceConfig2W RegQueryValueExW DeleteService EventRegister SetServiceStatus OpenServiceW RegisterServiceCtrlHandlerW EventUnregister StartServiceCtrlDispatcherW EventWriteString RegOpenKeyExW SetSecurityDescriptorDacl StartServiceW AllocateAndInitializeSid RegSetValueExW RegEnumKeyExW SetEntriesInAclW ControlService FreeSid InitializeSecurityDescriptor CryptDestroyKey CryptAcquireContextW CryptDecrypt CryptSetKeyParam RegCreateKeyExW CryptImportKey CryptReleaseContext CreateServiceW RegCloseKey QueryServiceStatus CloseServiceHandle OpenSCManagerW

ole32

CoUninitialize CoCreateInstance CoTaskMemFree CoInitializeEx PropVariantClear CLSIDFromString StringFromGUID2

oleaut32

SysFreeString SysStringByteLen SysAllocStringLen SysStringLen SysAllocString SysAllocStringByteLen

rpcrt4

RpcBindingVectorFree RpcServerUseProtseqEpW RpcServerUnregisterIf RpcServerRegisterIf3 NdrServerCallAll RpcServerListen NdrClientCall3 NdrServerCall2 RpcServerInqBindings RpcEpUnregister RpcEpRegisterW

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

winsqlite3

sqlite3_step sqlite3_column_blob sqlite3_close sqlite3_prepare16_v2 sqlite3_column_int sqlite3_finalize sqlite3_errmsg sqlite3_errcode sqlite3_open16

propsys

PSStringFromPropertyKey InitPropVariantFromCLSID

Name

.text

Size

282KB

Virtual Size

281KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_606c4f1c4b9f6fbce8fc8c51c5615836_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

advapi32

ole32

oleaut32

rpcrt4

api-ms-win-security-base-l1-2-2

winsqlite3

propsys

generic