2026-10-05_6537b278c7039551107274c676e5e1b8_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-05_6537b278c7039551107274c676e5e1b8_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 2.6MB
Sample261006-2y3ehsxv6l
SHA256 fe6d7956fd64e0b78bc22799f7a03b4afac775306105c5d873deb33cc5a3bdf9
MD5 6537b278c7039551107274c676e5e1b8
SHA1 9600f1bbfbcdb92170f258b8e79d74aeedf2d21f
SHA512 8ea145518896c012a1876097bd9a0ab136d3cd3f2dca7e5733f85edfc582d508db15dd562733d180f3ba77f45c3c50446238bd6058e10c4b4ce3114e2a93daf7
SSDEEP 49152:dnqFGr7HVjepA3DRAGE5dUflkTTsMfJff+aiRnXPDakkP3exP5mA03QEwAMY:dqFMjlEUdvMfJKRXPfUOxP5AjVMY
TLSH
T112C5E00B676412FAC0ABC174C6375D46D6B17805037456EB17E8ABA13F23AE69F3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-05_6537b278c7039551107274c676e5e1b8_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-05_6537b278c7039551107274c676e5e1b8_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 2.6MB

2026-10-05_6537b278c7039551107274c676e5e1b8_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH ef47aa4b431819141465cc3735d375e5
SHA256 fe6d7956fd64e0b78bc22799f7a03b4afac775306105c5d873deb33cc5a3bdf9
MD5 6537b278c7039551107274c676e5e1b8
SHA1 9600f1bbfbcdb92170f258b8e79d74aeedf2d21f
SHA512 8ea145518896c012a1876097bd9a0ab136d3cd3f2dca7e5733f85edfc582d508db15dd562733d180f3ba77f45c3c50446238bd6058e10c4b4ce3114e2a93daf7
SSDEEP 49152:dnqFGr7HVjepA3DRAGE5dUflkTTsMfJff+aiRnXPDakkP3exP5mA03QEwAMY:dqFMjlEUdvMfJKRXPfUOxP5AjVMY
TLSH
T112C5E00B676412FAC0ABC174C6375D46D6B17805037456EB17E8ABA13F23AE69F3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

726320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\agent\workspace\p-34eb88c94f1449d1b342f8071f58cae7\src\bugly_windows_build_env\crashpad\out\x64_release\crashpad_handler.pdb

kernel32

GetFileSizeEx CreateFileW GetPrivateProfileStringW CloseHandle GetCurrentThreadId FormatMessageW GetLocalTime GetCurrentProcessId EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection SetLastError GetFileInformationByHandleEx GetCurrentProcess RegisterWaitForSingleObject TerminateProcess GetQueuedCompletionStatus WaitForSingleObject DuplicateHandle DisconnectNamedPipe OpenProcess PostQueuedCompletionStatus CreateEventW Sleep SetEvent LoadLibraryW CreateThread UnregisterWaitEx CreateIoCompletionPort LoadLibraryExW ConnectNamedPipe ExitProcess CreateDirectoryW FindFirstFileExW RemoveDirectoryW GetFileAttributesW DeleteFileW GetFileTime SetNamedPipeHandleState CreateNamedPipeW GetVersion TransactNamedPipe WaitNamedPipeW FindClose ReleaseSemaphore CreateSemaphoreW GetStdHandle WriteFile SetEndOfFile UnlockFileEx SetFilePointerEx LockFileEx GetFileType FormatMessageA GetSystemTimeAsFileTime FindNextFileW LocalFree GetTimeZoneInformation GetSystemInfo IsProcessorFeaturePresent VerSetConditionMask VerifyVersionInfoW Wow64GetThreadContext SuspendThread ResumeThread GetThreadContext GetProcessTimes GetSystemDefaultLCID GetThreadLocale GetUserDefaultLCID CreateProcessW IsWow64Process WriteProcessMemory VirtualAllocEx ReadProcessMemory SleepEx IsDebuggerPresent UnmapViewOfFile CreateFileMappingW MapViewOfFile DeviceIoControl CreateFileA SizeofResource MultiByteToWideChar LockResource GlobalAlloc CreateTimerQueue FindResourceExW IsDBCSLeadByte LoadResource FindResourceW GlobalLock lstrcpyW GlobalUnlock WideCharToMultiByte GetPrivateProfileSectionW RtlUnwind DeleteTimerQueueTimer DeleteTimerQueueEx CreateTimerQueueTimer OutputDebugStringW GetProcessId WritePrivateProfileStringW SetUnhandledExceptionFilter GetModuleHandleW GetProcessHeap DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc RaiseException HeapReAlloc SwitchToThread InitializeCriticalSection VirtualQueryEx WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage SetStdHandle GetFullPathNameW GetCurrentDirectoryW ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleHandleExW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW GetCommandLineW GetCommandLineA FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwindEx RtlPcToFileHeader GetStartupInfoW InitializeSListHead UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable GetCPInfo InitOnceExecuteOnce LCMapStringEx EncodePointer TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive GetStringTypeW QueryPerformanceFrequency QueryPerformanceCounter ReadFile LoadLibraryA GetLastError HeapSize InitializeCriticalSectionEx SetProcessShutdownParameters GetModuleFileNameW LoadLibraryExA HeapFree GlobalFree SetConsoleCtrlHandler

advapi32

RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey ImpersonateNamedPipeClient RevertToSelf BuildSecurityDescriptorW ConvertStringSecurityDescriptorToSecurityDescriptorW SystemFunction036 BuildExplicitAccessWithNameW RegOpenKeyExA RegDeleteValueW RegQueryValueExA RegQueryValueExW

user32

RegisterClassW CreateWindowExW SetWindowLongPtrW DestroyWindow PostMessageW DefWindowProcW GetMessageW DispatchMessageW UnregisterClassW TranslateMessage EnableWindow EndPaint BeginPaint InvalidateRect LoadImageW DialogBoxParamW GetSysColorBrush GetWindowLongPtrW GetWindowTextW KillTimer DrawIconEx DrawTextW GetDlgItem GetClientRect MapDialogRect SetClipboardData SendDlgItemMessageW SetDlgItemTextW EmptyClipboard CloseClipboard ClientToScreen SetTimer OpenClipboard GetWindowTextLengthW EndDialog MapWindowPoints GetWindowThreadProcessId GetMenuItemCount CreatePopupMenu TrackPopupMenu IsWindow DestroyMenu RegisterClipboardFormatW GetKeyState CallWindowProcW GetWindowRect SetWindowPos SendMessageW SetWindowTextW ShowWindow

winhttp

WinHttpWriteData WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpCrackUrl WinHttpConnect WinHttpSendRequest WinHttpSetTimeouts

powrprof

CallNtPowerInformation

ole32

OleUninitialize CoTaskMemFree CoCreateGuid StringFromCLSID OleInitialize DoDragDrop

shlwapi

PathFileExistsW PathRemoveFileSpecW

gdiplus

GdiplusStartup

comctl32

ImageList_Create ImageList_ReplaceIcon InitCommonControlsEx

gdi32

SelectObject CreateFontW DeleteObject SetTextColor GetStockObject SetBkMode

oleaut32

SysStringLen SysStringByteLen SysAllocStringByteLen SysFreeString SysAllocString

shell32

ShellExecuteW SHGetFileInfoW ord155 SHBindToParent SHGetDesktopFolder

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

931KB

Virtual Size

930KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

271KB

Virtual Size

271KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-05_6537b278c7039551107274c676e5e1b8_cobalt-strike_coinminer_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

advapi32

user32

winhttp

powrprof

ole32

shlwapi

gdiplus

comctl32

gdi32

oleaut32

shell32

version

generic