2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.7MB
Sample261001-svs71avcma
SHA256 4124a5691e84eda1088229f9f55ceb9ed04de53e4712864b7b99581eed16ed61
MD5 431320219a2a4e16206d2b488654dd90
SHA1 837baed36e9f8ac831f7d6d155001c98d2b57eee
SHA512 8b260bfc4ce7435117708e7c8e972b21a9bec728c009917b430b087c65360f4fd208cc5069bbafe345fa1da8707f1d896fcf2300e58ad078cf5d8b7f8a48ced3
SSDEEP 24576:SEIU58bYMKEz5CYtabDxHjsbkqRV4EgFMp3C9UZ9VCXif:SxQ5XECRvVYkqb4frs+i
TLSH
T18085F14AF7A404F8E5779138C8A64A06E772BC5603B05BCF23A446662F336F15E3E761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.7MB

2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 534a1143bd7c6d9f0c98f18367c5e20f
SHA256 4124a5691e84eda1088229f9f55ceb9ed04de53e4712864b7b99581eed16ed61
MD5 431320219a2a4e16206d2b488654dd90
SHA1 837baed36e9f8ac831f7d6d155001c98d2b57eee
SHA512 8b260bfc4ce7435117708e7c8e972b21a9bec728c009917b430b087c65360f4fd208cc5069bbafe345fa1da8707f1d896fcf2300e58ad078cf5d8b7f8a48ced3
SSDEEP 24576:SEIU58bYMKEz5CYtabDxHjsbkqRV4EgFMp3C9UZ9VCXif:SxQ5XECRvVYkqb4frs+i
TLSH
T18085F14AF7A404F8E5779138C8A64A06E772BC5603B05BCF23A446662F336F15E3E761
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

98872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\pc\other_tools\driverinstaller\InfInstaller\x64\Release\InfInstallerx64.pdb

kernel32

LocalAlloc GetModuleHandleA Sleep CopyFileA GetLastError GetFileAttributesA DeleteFileA WaitForSingleObject GetSystemInfo GetProcAddress LocalFree RemoveDirectoryA CreateProcessA CreateDirectoryA GetPrivateProfileStringA SetEndOfFile PeekNamedPipe CreatePipe CloseHandle ReadFile WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW GetFileAttributesExW WideCharToMultiByte MultiByteToWideChar LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW FindClose FindFirstFileExW FindNextFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapReAlloc RtlUnwind

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

shlwapi

PathFileExistsA

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo CM_Locate_DevNodeA SetupDiBuildDriverInfoList SetupDiGetDriverInfoDetailA SetupUninstallOEMInfA SetupDiEnumDriverInfoA CM_Reenumerate_DevNode SetupDiGetClassDevsA SetupDiGetClassDevsExA

newdev

DiUninstallDevice

Name

.text

Size

247KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

936B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_431320219a2a4e16206d2b488654dd90_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

advapi32

shlwapi

setupapi

newdev

generic