2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar
Size 1.4MB
Sample261002-ws439sxtat
SHA256 7b9b1554bee847bb21b7287929e2aa6a3511448cb8e7d91cf3b399cce73f6ab7
MD5 2477005760383ef6ed8bfe18a1e8558b
SHA1 a522ae788f9c9639dde2d9fbac03307aded0b10d
SHA512 2f0d2ea0cc2c55cda7d8d84e474012fc01a5b2008b92a412dd9daa4a6c9e451e38431c6938f20f346d99abfb188e7cef30443dbc102a75fe39b57a7b8c1531d5
SSDEEP 24576:mVrsHVVCssH6M9+JbESZKWvfWiGGC5SYCWatr0zAiX90z/F0jsFB3SQkI:mVrs1279+VtZKMkBaB0zj0yjoB2
TLSH
T12365AE2DE6A801EAE06A9139EC554706E7B37F15137186CB33A0765A1F376E08F3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

.exe 1.4MB

2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 8b745debaf84a5ecaebbea84259664b3
SHA256 7b9b1554bee847bb21b7287929e2aa6a3511448cb8e7d91cf3b399cce73f6ab7
MD5 2477005760383ef6ed8bfe18a1e8558b
SHA1 a522ae788f9c9639dde2d9fbac03307aded0b10d
SHA512 2f0d2ea0cc2c55cda7d8d84e474012fc01a5b2008b92a412dd9daa4a6c9e451e38431c6938f20f346d99abfb188e7cef30443dbc102a75fe39b57a7b8c1531d5
SSDEEP 24576:mVrsHVVCssH6M9+JbESZKWvfWiGGC5SYCWatr0zAiX90z/F0jsFB3SQkI:mVrs1279+VtZKMkBaB0zj0yjoB2
TLSH
T12365AE2DE6A801EAE06A9139EC554706E7B37F15137186CB33A0765A1F376E08F3AF11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

234416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

FCAT_DT_Capture_x64.pdb

kernel32

GetModuleFileNameA SetLastError GetFullPathNameW GetModuleFileNameW LocalAlloc CreateFileW GetFileAttributesW GetSystemDirectoryW GetLastError CloseHandle GetProcAddress LocalFree VerSetConditionMask CreateProcessW GetModuleHandleW FreeLibrary VerifyVersionInfoW LoadLibraryExW CreateDirectoryW SetConsoleCtrlHandler EnterCriticalSection GetCommandLineW SetConsoleTitleA RegisterWaitForSingleObject UnregisterWait OutputDebugStringA LeaveCriticalSection InitializeCriticalSection WaitForSingleObject GetCurrentThreadId FindFirstChangeNotificationW CreateEventW Sleep AttachConsole OutputDebugStringW SetEvent FindCloseChangeNotification QueryPerformanceFrequency ResetEvent GetLocalTime FindNextChangeNotification DeleteCriticalSection GetCurrentProcessId lstrcmpiW QueryPerformanceCounter AllocConsole HeapFree SetDefaultDllDirectories CreateMutexW GetCurrentDirectoryA UnmapViewOfFile SetProcessMitigationPolicy CreateThread HeapAlloc CreateFileMappingA GetProcessHeap lstrcpyW OpenFileMappingA MapViewOfFile MulDiv WritePrivateProfileStringW GetCurrentProcess GetPrivateProfileIntW LoadLibraryExA GetPrivateProfileStringW WaitForMultipleObjects OpenProcess CopyFileW FormatMessageA CreateEventA SetEndOfFile WriteConsoleW HeapSize GetTimeZoneInformation HeapReAlloc SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadFile ReadConsoleW PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleMode SetFilePointerEx RaiseException GetSystemInfo VirtualProtect VirtualQuery RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead MultiByteToWideChar GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI MoveFileExW GetFileInformationByHandleEx WideCharToMultiByte GetStringTypeW TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo RtlUnwindEx RtlPcToFileHeader InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetConsoleCP ExitProcess GetStdHandle WriteFile GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx RtlUnwind

ole32

CoTaskMemFree

shlwapi

PathFileExistsW

bcrypt

BCryptImportKeyPair BCryptVerifySignature BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyKey

Name

.text

Size

569KB

Virtual Size

568KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_2477005760383ef6ed8bfe18a1e8558b_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

kernel32

ole32

shlwapi

bcrypt

generic