2026-10-10_c5fb03302be7f23a52e1af5739daab80_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_c5fb03302be7f23a52e1af5739daab80_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.4MB
Sample261011-dbf11aet3x
SHA256 c551f6439e99f22866c615dad0fbbb1ca1c405c0fe57bbf1830f4b920442ad32
MD5 c5fb03302be7f23a52e1af5739daab80
SHA1 6e116b1c8d0c576af9c305959db59815db0d6680
SHA512 341ba16b7e0eaba273f736ac69984ee3d88ef7c7cf532b315ff9870bb53ee6032c9243758217f9fad04397fcf2e97f8f2984c65da35f58bf008b7275598f47d0
SSDEEP 24576:rAnCpIw1tFaFSzQ8spJQlWbFCvlYr8knG7dO7A:rACISoGQ8spGlWb4CQp7dO
TLSH
T1D565025573F840E1E573D279C85A0212FB32786153249B9F2BA4433A9F73B92DD3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_c5fb03302be7f23a52e1af5739daab80_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-10_c5fb03302be7f23a52e1af5739daab80_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.4MB

2026-10-10_c5fb03302be7f23a52e1af5739daab80_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 143050a7798369936384fe2d6f6c6ec4
SHA256 c551f6439e99f22866c615dad0fbbb1ca1c405c0fe57bbf1830f4b920442ad32
MD5 c5fb03302be7f23a52e1af5739daab80
SHA1 6e116b1c8d0c576af9c305959db59815db0d6680
SHA512 341ba16b7e0eaba273f736ac69984ee3d88ef7c7cf532b315ff9870bb53ee6032c9243758217f9fad04397fcf2e97f8f2984c65da35f58bf008b7275598f47d0
SSDEEP 24576:rAnCpIw1tFaFSzQ8spJQlWbFCvlYr8knG7dO7A:rACISoGQ8spGlWb4CQp7dO
TLSH
T1D565025573F840E1E573D279C85A0212FB32786153249B9F2BA4433A9F73B92DD3A760
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

36428

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\WinRAR\RarExt\Installer\x64\Release\RarExtInstaller.pdb

kernel32

GetLastError InitializeCriticalSectionEx DeleteCriticalSection GetModuleFileNameW CompareStringEx VerifyVersionInfoW VerSetConditionMask WaitForSingleObject CreateEventW SetEvent FormatMessageW WriteConsoleW CreateFileW CloseHandle GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetStringTypeW SetStdHandle GetProcessHeap IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree HeapAlloc GetFileType HeapSize HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW

user32

MessageBoxW

shell32

SHChangeNotify

shlwapi

SHCreateStreamOnFileEx ord176

oleaut32

SysAllocString SetErrorInfo GetErrorInfo SysStringLen VariantClear SysFreeString

api-ms-win-core-com-l1-1-0

CoTaskMemFree CoUninitialize CoInitializeEx CoCreateFreeThreadedMarshaler CoCreateInstance

Name

.text

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_c5fb03302be7f23a52e1af5739daab80_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

shell32

shlwapi

oleaut32

api-ms-win-core-com-l1-1-0

generic