evolutionrat | 2026-10-03_b50057bfc1e30d7e52c876134b293e67_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-03_b50057bfc1e30d7e52c876134b293e67_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.9MB
Sample261004-ea546syfmb
SHA256 9b065d974ff18144901b0489d818af70bb411777cf3a6c7d8aa64cec86e70e9e
MD5 b50057bfc1e30d7e52c876134b293e67
SHA1 7380d6ea2469b60ce87bea384e986f779e21715a
SHA512 803433c5c1d7088386b362203b6bdb2e3b2b6c51fa585859328b492cfcbbc182cbf771ce9b61e7e2126123c335cf94aa6acefcf022aa3eafa831d5a89105c168
SSDEEP 24576:mEiHi0g9LpYKvsvvYudn4NzJlvBIuy9kr/NSbgb83jb5V0LEkAzO0:mEZ0rGHVNzzBJIi3w3kAz
TLSH
T1CF958E4BF2A400EDD467C178C9165607EB77BC0617205BDF1690BAAA6F33AE11E7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat evolutionrat

Malware Config

Extracted

Family

evolutionrat

194.110.172.185:7770

Attributes

install
false

Signatures

Family: EvolutionRAT
EvolutionRAT is a Windows RAT written in C.
rat evolutionrat

Detects Reflective DLL injection artifacts 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_ReflectiveLoader

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-03_b50057bfc1e30d7e52c876134b293e67_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-03_b50057bfc1e30d7e52c876134b293e67_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.9MB

2026-10-03_b50057bfc1e30d7e52c876134b293e67_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH ca0be66b10fdd8db5db8e7a7141ae5eb
SHA256 9b065d974ff18144901b0489d818af70bb411777cf3a6c7d8aa64cec86e70e9e
MD5 b50057bfc1e30d7e52c876134b293e67
SHA1 7380d6ea2469b60ce87bea384e986f779e21715a
SHA512 803433c5c1d7088386b362203b6bdb2e3b2b6c51fa585859328b492cfcbbc182cbf771ce9b61e7e2126123c335cf94aa6acefcf022aa3eafa831d5a89105c168
SSDEEP 24576:mEiHi0g9LpYKvsvvYudn4NzJlvBIuy9kr/NSbgb83jb5V0LEkAzO0:mEZ0rGHVNzzBJIi3w3kAz
TLSH
T1CF958E4BF2A400EDD467C178C9165607EB77BC0617205BDF1690BAAA6F33AE11E7E321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Reflective DLL injection artifacts
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1165520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

freeaddrinfo __WSAFDIsSet WSAIoctl WSACleanup WSAStartup socket shutdown setsockopt send select recv ntohs getsockopt getsockname ioctlsocket connect closesocket getaddrinfo

advapi32

RevertToSelf CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegSetValueExA RegQueryValueExA RegOpenKeyExA OpenProcessToken AdjustTokenPrivileges DuplicateTokenEx ImpersonateLoggedOnUser LookupPrivilegeValueA LookupPrivilegeValueW GetUserNameA RegCloseKey RegDeleteValueA

user32

SetThreadDesktop OpenInputDesktop GetThreadDesktop GetKeyboardLayout ToUnicodeEx wsprintfW CloseDesktop EnumDesktopWindows CreateDesktopW OpenDesktopW GetMessageA LockWorkStation GetAncestor GetCursorInfo BlockInput GetGUIThreadInfo EnumDisplayMonitors GetMonitorInfoA SystemParametersInfoA ChangeDisplaySettingsA GetIconInfo CopyIcon DrawIconEx SetSystemCursor DestroyCursor CreateCursor CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindow GetWindowThreadProcessId GetTopWindow EnumWindows SetWindowLongW GetWindowLongW WindowFromPoint ScreenToClient GetCursorPos SetCursor SetCursorPos GetWindowRect GetClientRect GetWindowTextLengthA GetWindowTextW GetWindowTextA InvalidateRect SetWindowRgn EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow GetSystemMetrics KillTimer SetTimer MsgWaitForMultipleObjects MapVirtualKeyW MapVirtualKeyA SendInput ToUnicode GetKeyboardState GetAsyncKeyState GetKeyState GetFocus SetFocus EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard IsWindowVisible GetWindowPlacement SetWindowPos SetLayeredWindowAttributes PrintWindow ShowWindow DestroyWindow CreateWindowExW RegisterClassW DefWindowProcW PostMessageW PostMessageA SendMessageTimeoutW SwapMouseButton PeekMessageA DispatchMessageA TranslateMessage

shell32

SHFileOperationA ShellExecuteW SHCreateDirectoryExA SHGetFolderPathA ShellExecuteA

winmm

waveInAddBuffer waveInStart waveInStop waveInReset timeBeginPeriod timeEndPeriod waveInOpen waveInClose waveInUnprepareHeader waveInPrepareHeader

crypt32

CryptStringToBinaryA CryptUnprotectData

bcrypt

BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider

ncrypt

NCryptOpenStorageProvider NCryptDecrypt NCryptFreeObject NCryptOpenKey

ole32

GetHGlobalFromStream CoUninitialize CoInitializeEx CoSetProxyBlanket CoCreateInstance CoTaskMemFree CreateStreamOnHGlobal

oleaut32

SysAllocString SysFreeString SysStringByteLen SysAllocStringByteLen VariantInit VariantClear

iphlpapi

SetTcpEntry GetExtendedTcpTable GetAdaptersInfo

d3d11

D3D11CreateDevice

gdiplus

GdipCreateStringFormat GdipDrawString GdipDeleteFont GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipGetImageEncoders GdipGetImageEncodersSize GdipDrawImageRectI GdipFillEllipse GdipDrawArc GdipSetInterpolationMode GdipSetTextRenderingHint GdipSetStringFormatAlign GdipDeleteGraphics GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromScan0 GdipSaveImageToStream GdipDisposeImage GdipCloneImage GdipLoadImageFromStream GdipSetPenEndCap GdipSetStringFormatLineAlign GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipDeleteStringFormat GdipSetSmoothingMode GdipSetPenStartCap

gdi32

CreateDIBSection BitBlt CombineRgn CreateCompatibleBitmap CreateCompatibleDC CreateRectRgn DeleteDC DeleteObject EnumFontFamiliesExA GetDeviceCaps SelectObject GetObjectA

shlwapi

PathRemoveFileSpecA

rstrtmgr

RmGetList RmStartSession RmEndSession RmRegisterResources

mfplat

MFCreateMediaType MFCreateAttributes MFShutdown MFStartup

mf

MFEnumDeviceSources

mfreadwrite

MFCreateSourceReaderFromMediaSource

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

kernel32

DeviceIoControl DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException AreFileApisANSI HeapCreate GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW CreateFileW GetFileAttributesW HeapValidate HeapSize FormatMessageW GetDiskFreeSpaceA GetFileAttributesExW OutputDebugStringW FlushViewOfFile WaitForSingleObjectEx DeleteFileW HeapReAlloc GetSystemInfo LoadLibraryW HeapCompact HeapDestroy UnlockFile LockFileEx SystemTimeToFileTime FreeLibrary GetSystemTimeAsFileTime GetSystemTime FormatMessageA QueryPerformanceCounter FlushFileBuffers K32GetProcessMemoryInfo K32GetModuleBaseNameA Thread32Next Thread32First Process32Next Process32First Process32NextW Process32FirstW CreateToolhelp32Snapshot GetConsoleWindow FreeConsole GetUserDefaultUILanguage GetLocaleInfoA WideCharToMultiByte MultiByteToWideChar GetTimeZoneInformation FileTimeToSystemTime GetComputerNameA CopyFileA FindResourceA LocalFree GlobalFree GlobalLock GlobalUnlock GlobalAlloc LoadLibraryA LockResource LoadResource GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameA Wow64SetThreadContext Wow64GetThreadContext UnmapViewOfFile VirtualFreeEx MapViewOfFile CreateFileMappingW WriteProcessMemory ReadProcessMemory VirtualAllocEx VirtualFree VirtualAlloc GetNativeSystemInfo GetSystemDirectoryA GetTickCount64 GetTickCount GetLocalTime OpenProcess SetThreadContext GetThreadContext CreateProcessW CreateProcessA ResumeThread SuspendThread OpenThread GetCurrentThreadId CreateRemoteThread CreateThread TerminateProcess ExitProcess QueryPerformanceFrequency SetStdHandle SetEnvironmentVariableW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetCurrentProcessId GetCurrentProcess Sleep CreateEventW CreateMutexA WaitForSingleObject ResetEvent GlobalSize WriteConsoleW FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle GetModuleFileNameW GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer SleepConditionVariableSRW WakeAllConditionVariable GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx SizeofResource SetEvent GetProcessHeap HeapFree HeapAlloc CreatePipe GetLastError SetHandleInformation DuplicateHandle CloseHandle GetVolumeInformationA GetTempPathA GetTempPathW WriteFile ReadFile GetLogicalDrives GetFinalPathNameByHandleW GetFileType GetFileSizeEx GetFileSize GetFileAttributesExA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentVariableA SearchPathA CreateDirectoryA CreateFileA DeleteFileA FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW GetDiskFreeSpaceExA GetFileAttributesA

ntdll

RtlUnwindEx RtlLookupFunctionEntry RtlCaptureContext RtlPcToFileHeader RtlVirtualUnwind RtlUnwind

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

226KB

Virtual Size

225KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cfg

Size

512B

Virtual Size

163B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

306KB

Virtual Size

306KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-10-03_b50057bfc1e30d7e52c876134b293e67_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

ws2_32

advapi32

user32

shell32

winmm

crypt32

bcrypt

ncrypt

ole32

oleaut32

iphlpapi

d3d11

gdiplus

gdi32

shlwapi

rstrtmgr

mfplat

mf

mfreadwrite

version

kernel32

ntdll

generic