2026-10-02_2d86b39c9eb07673986fa6af83ba8054_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_2d86b39c9eb07673986fa6af83ba8054_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 5.9MB
Sample261003-snwdsast2k
SHA256 08287bca1dcf331179833d51bdb2a5419f16aaabb33142997d870f021d7ed09a
MD5 2d86b39c9eb07673986fa6af83ba8054
SHA1 52f0476244148aecad700ec181f814d11e59e214
SHA512 26f72c749e22e864d02f131bda4e8174cda66bc5379325fae9d2400c04df9ca1d22a8fde3e5caae978e59ff9e2d3432028665b379aa4f5f6a5fbd908bc37c28d
SSDEEP 49152:VBBldUPvK0DZyYH3CzcU31NUM8T8+HEOT8+HEQT8+HEQT8+HEQT8+HEQT8+HEQTs:PBUjVyz/1fmo
TLSH
T16056E006F3C70A9AEF37567CC9425A17D271BC09136183DB6BDA4A675AAB9E04F3D300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_2d86b39c9eb07673986fa6af83ba8054_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-10-02_2d86b39c9eb07673986fa6af83ba8054_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 5.9MB

2026-10-02_2d86b39c9eb07673986fa6af83ba8054_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 5d8f98450dd8d43a220ce643a299fc16
SHA256 08287bca1dcf331179833d51bdb2a5419f16aaabb33142997d870f021d7ed09a
MD5 2d86b39c9eb07673986fa6af83ba8054
SHA1 52f0476244148aecad700ec181f814d11e59e214
SHA512 26f72c749e22e864d02f131bda4e8174cda66bc5379325fae9d2400c04df9ca1d22a8fde3e5caae978e59ff9e2d3432028665b379aa4f5f6a5fbd908bc37c28d
SSDEEP 49152:VBBldUPvK0DZyYH3CzcU31NUM8T8+HEOT8+HEQT8+HEQT8+HEQT8+HEQT8+HEQTs:PBUjVyz/1fmo
TLSH
T16056E006F3C70A9AEF37567CC9425A17D271BC09136183DB6BDA4A675AAB9E04F3D300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

977552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Daniel\Documents\loader_11\x64\Release\artSpoofer.pdb

d3d11

D3D11CreateDevice

d3dcompiler_47

D3DCompile

ole32

CoInitializeEx CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeSecurity CoTaskMemFree

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpCloseHandle WinHttpReceiveResponse WinHttpSendRequest WinHttpOpen WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpGetDefaultProxyConfiguration

crypt32

CryptProtectData CryptUnprotectData

kernel32

GetCurrentProcessId CreateProcessW GetProcAddress FreeLibrary GlobalMemoryStatusEx WideCharToMultiByte CreateDirectoryW ReadFile GetFileSizeEx GetLastError LocalFree Sleep VirtualFree DeviceIoControl VirtualAlloc GetCurrentThreadId GetModuleHandleA GetTempPathW GetSystemFirmwareTable GetEnvironmentVariableW GlobalFree CreateRemoteThreadEx WriteProcessMemory VirtualProtect GetCurrentProcess TerminateProcess GetProcessId DuplicateHandle OpenProcess K32GetModuleFileNameExA LoadLibraryA CreateThread VirtualProtectEx VirtualAllocEx CreateFileW ReadProcessMemory GetModuleHandleW CreateRemoteThread GetTickCount OpenThread IsDebuggerPresent CheckRemoteDebuggerPresent FlushFileBuffers GetFileAttributesExW QueryDosDeviceW GetLogicalDrives WaitForSingleObject CreateToolhelp32Snapshot Process32NextW MoveFileExW QueryFullProcessImageNameW QueryPerformanceCounter GetDriveTypeW GlobalAlloc GlobalLock GlobalUnlock GetLocaleInfoA QueryPerformanceFrequency GetModuleFileNameW ReleaseSRWLockExclusive CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc CreateFileA GetFileInformationByHandleEx FormatMessageA GetLocaleInfoEx WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime CloseHandle DeleteFileW GetTickCount64 MultiByteToWideChar GetSystemDirectoryW InitializeSListHead WriteFile AcquireSRWLockExclusive SleepConditionVariableSRW InitOnceComplete InitOnceBeginInitialize FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFinalPathNameByHandleW SetFileInformationByHandle Process32FirstW GetFileAttributesW CreateFile2 ExitProcess

user32

GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor IsWindowUnicode ReleaseCapture PeekMessageW GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetMessageExtraInfo GetKeyState GetWindowTextA SetWindowsHookW EnumWindows TranslateMessage FindWindowW GetClientRect PostQuitMessage GetWindowTextLengthA FindWindowA UpdateWindow SetWindowPos GetSystemMetrics DispatchMessageW ShowWindow RegisterClassExW SetCursorPos GetClipboardData UnregisterClassW ScreenToClient SetClipboardData MessageBoxA DefWindowProcW DestroyWindow IsWindowVisible MessageBoxW CreateWindowExW

advapi32

CryptHashData RegDeleteValueW RegQueryValueExW QueryServiceStatus CloseServiceHandle OpenSCManagerA RegOpenKeyExA RegQueryValueExA RegCloseKey RegOpenKeyW RegCreateKeyW RegDeleteTreeW RegSetKeyValueW CryptReleaseContext CryptGetHashParam CryptDestroyHash RegOpenKeyExW CryptCreateHash CryptAcquireContextA GetTokenInformation OpenServiceA OpenProcessToken ControlService

shell32

SHGetKnownFolderPath ShellExecuteA

oleaut32

SysFreeString VariantClear SysAllocString VariantInit

msvcp140

?good@ios_base@std@@QEBA_NXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z _Query_perf_frequency _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ?_Winerror_map@std@@YAHH@Z ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?bad@ios_base@std@@QEBA_NXZ ?eof@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?uncaught_exceptions@std@@YAHXZ

ntdll

NtQuerySystemInformation RtlInitUnicodeString

ws2_32

htonl WSAGetLastError setsockopt closesocket shutdown WSAStartup send socket connect recv getsockopt inet_ntop htons

dcomp

DCompositionCreateDevice

winmm

mciSendStringW

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __std_exception_destroy __std_exception_copy __std_terminate wcsstr strstr strchr strrchr longjmp memcpy memmove memset memchr memcmp __C_specific_handler __current_exception __current_exception_context __intrinsic_setjmp

api-ms-win-crt-stdio-l1-1-0

fseek __acrt_iob_func __stdio_common_vswprintf_s __stdio_common_vsscanf __stdio_common_vsprintf fputc __stdio_common_vfprintf __p__commode ftell _set_fmode _wfopen fflush fclose fgetc fwrite fgetpos _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _wremove _lock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc realloc free

api-ms-win-crt-utility-l1-1-0

qsort rand srand

api-ms-win-crt-string-l1-1-0

_stricmp tolower isalnum isspace strncmp towlower _wcsicmp strncpy_s _wcsnicmp strncpy strcmp strlen wcslen

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit _seh_filter_exe _set_app_type _register_onexit_function _get_narrow_winmain_command_line _initterm _initterm_e _exit _beginthreadex _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _initialize_narrow_environment terminate exit _configure_narrow_argv abort

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

cosf ceilf floorf sqrtf fmodf sinf acosf __setusermatherr

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_2d86b39c9eb07673986fa6af83ba8054_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

d3d11

d3dcompiler_47

ole32

winhttp

crypt32

kernel32

user32

advapi32

shell32

oleaut32

msvcp140

ntdll

ws2_32

dcomp

winmm

imm32

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic