2026-10-11_451ccd475b4a5cd09176079222620080_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_451ccd475b4a5cd09176079222620080_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 1.8MB
Sample261012-21dtyafa53
SHA256 4c318fcc2ded170d3aaf9d94c34e9f8c475c6dfa3f48e7298a19610adf48ab54
MD5 451ccd475b4a5cd09176079222620080
SHA1 eff0e9764c3a829b9456d833b08196ca2c434a02
SHA512 33d349eaa381a967301d5e4188c91806a5b9dcfc99c5cb956144ba447c464811a48a4840e5660308646c6972295bdbae1871295eaf8aeb781785d1dd73f9c896
SSDEEP 49152:LkMA0Vax0x7tk5Dmg27RnWGj6z8fwebBhO65Fdt:LfVb7tk5D527BWG48fwebBhOQdt
TLSH
T10F95127677A102F8D0778138C6829562F5B2B8251374FEDF46A88AB12F235E14F7DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_451ccd475b4a5cd09176079222620080_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-10-11_451ccd475b4a5cd09176079222620080_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 1.8MB

2026-10-11_451ccd475b4a5cd09176079222620080_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 2809a0b06626ae0927b92f7f4702c3bf
SHA256 4c318fcc2ded170d3aaf9d94c34e9f8c475c6dfa3f48e7298a19610adf48ab54
MD5 451ccd475b4a5cd09176079222620080
SHA1 eff0e9764c3a829b9456d833b08196ca2c434a02
SHA512 33d349eaa381a967301d5e4188c91806a5b9dcfc99c5cb956144ba447c464811a48a4840e5660308646c6972295bdbae1871295eaf8aeb781785d1dd73f9c896
SSDEEP 49152:LkMA0Vax0x7tk5Dmg27RnWGj6z8fwebBhO65Fdt:LfVb7tk5D527BWG48fwebBhOQdt
TLSH
T10F95127677A102F8D0778138C6829562F5B2B8251374FEDF46A88AB12F235E14F7DB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

203040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ssh-agent.pdb

libcrypto

BN_bin2bn DSA_generate_parameters_ex DSA_SIG_free BN_dup RSA_generate_key_ex BN_set_flags RSA_public_decrypt RSA_new RSA_set0_crt_params RSA_free BN_free BN_set_word RSA_sign BN_div RSA_set0_factors RSA_get0_factors RSA_get0_crt_params RSA_set0_key BN_CTX_new BN_CTX_free EVP_sha384 EVP_md5 EVP_sha256 EVP_Digest DSA_generate_key EVP_sha1 DSA_get0_pqg EVP_sha512 EVP_CIPHER_CTX_key_length EVP_CIPHER_CTX_new EVP_aes_256_cbc DSA_set0_pqg DSA_SIG_new EVP_CipherInit EVP_aes_128_ctr DSA_new DSA_SIG_get0 DSA_set0_key DSA_do_verify BN_bn2bin EVP_aes_256_ctr DSA_get0_key DSA_do_sign DSA_free DSA_SIG_set0 EC_POINT_point2oct EVP_des_ede3_cbc EVP_aes_192_cbc EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_set_key_length EVP_aes_192_ctr EVP_Cipher EVP_aes_256_gcm EVP_aes_128_gcm EVP_CIPHER_CTX_free ECDSA_do_sign EC_POINT_cmp EC_KEY_set_private_key EC_KEY_generate_key ECDSA_SIG_get0 EC_KEY_set_public_key EC_KEY_free ECDSA_SIG_free ECDSA_SIG_set0 EC_KEY_set_asn1_flag ECDSA_do_verify EC_KEY_new_by_curve_name ECDSA_SIG_new RSA_blinding_on EC_GROUP_get_order BN_clear_free BN_value_one EC_METHOD_get_field_type EC_POINT_mul EC_POINT_get_affine_coordinates_GFp EC_KEY_set_group EC_POINT_is_at_infinity arc4random_buf RSA_get0_key EC_POINT_free EVP_aes_128_cbc EC_KEY_get0_public_key EC_GROUP_free EC_POINT_new EC_GROUP_cmp EC_GROUP_set_asn1_flag EC_GROUP_get_curve_name BN_new EC_KEY_get0_private_key EC_KEY_get0_group BN_cmp BN_sub explicit_bzero EC_GROUP_new_by_curve_name EC_GROUP_method_of BN_num_bits EC_KEY_METHOD_set_sign RSA_up_ref d2i_ECDSA_SIG EC_KEY_set_method RSA_meth_set_priv_enc EC_KEY_METHOD_get_sign RSA_meth_set1_name RSA_set_method RSA_meth_dup RSA_size RSA_get_default_method EC_POINT_oct2point EC_KEY_METHOD_new EC_KEY_up_ref EC_KEY_OpenSSL

kernel32

GetCommandLineW GetCommandLineA GetCurrentDirectoryW SetCurrentDirectoryW SetEnvironmentVariableW RtlPcToFileHeader RaiseException EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError RtlUnwindEx GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SetStdHandle LoadLibraryExW ReadConsoleOutputA SetConsoleCursorPosition GetConsoleWindow Beep FillConsoleOutputAttribute WriteConsoleOutputA ReadConsoleInputW SetConsoleCursorInfo SetConsoleWindowInfo GetConsoleCursorInfo ScrollConsoleScreenBufferA GetConsoleOutputCP SetConsoleScreenBufferSize SetConsoleTextAttribute FillConsoleOutputCharacterA CreateWaitableTimerA WriteConsoleW CancelSynchronousIo GetConsoleMode SetConsoleMode WaitForSingleObjectEx WaitForMultipleObjectsEx ExitProcess FindClose FindFirstFileExW FindNextFileW CreateThread ExitThread GetFinalPathNameByHandleW FreeLibraryAndExitThread QueueUserAPC VerifyVersionInfoW VerSetConditionMask ResetEvent SleepEx ReadFileEx CreateFileA SetConsoleCtrlHandler GetModuleFileNameW HeapFree HeapAlloc GetLastError FlsAlloc FlsGetValue FlsSetValue SetHandleInformation FlsFree CreateNamedPipeW WaitForMultipleObjects InitializeCriticalSectionEx GetNamedPipeClientProcessId VirtualProtect GetQueuedCompletionStatus OpenProcess CompareStringW LCMapStringW SetEvent CloseHandle GetCurrentProcessId CreateProcessW CreateEventA CreateIoCompletionPort ConnectNamedPipe ReadFile WriteFile CancelIoEx GetOverlappedResult HeapReAlloc GetStringTypeW LocalFree ReadConsoleW GetFileSizeEx GetFullPathNameW IsValidCodePage WriteFileEx GetCurrentProcess GetStdHandle TerminateProcess GetACP GetModuleHandleExW SetEndOfFile GetCurrentThreadId DuplicateHandle GetTickCount64 SetFilePointerEx GetFileType CreateNamedPipeA CancelIo OpenThread FlushFileBuffers MultiByteToWideChar WideCharToMultiByte GetExitCodeProcess GetOEMCP GetConsoleScreenBufferInfo GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW WaitForSingleObject CreateFileW GetProcessHeap HeapSize GetLocalTime GetProcAddress GetComputerNameW FreeLibrary GetDriveTypeW ExpandEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW

advapi32

ConvertSidToStringSidW GetSidIdentifierAuthority EventWrite EventRegister CopySid IsValidSecurityDescriptor GetLengthSid LookupAccountNameW CreateProcessAsUserW RegDeleteTreeA RevertToSelf RegCloseKey RegOpenCurrentUser RegCreateKeyExA RegDeleteKeyExA RegEnumKeyExW ImpersonateLoggedOnUser RegDeleteTreeW RegOpenKeyExA RegOpenKeyExW RegQueryValueExW CreateWellKnownSid RegCreateKeyExW IsWellKnownSid RegSetValueExW OpenProcessToken CheckTokenMembership DuplicateToken ConvertStringSecurityDescriptorToSecurityDescriptorW DuplicateTokenEx GetTokenInformation OpenSCManagerW SetServiceStatus RegisterServiceCtrlHandlerW StartServiceA StartServiceCtrlDispatcherW OpenServiceW LookupAccountSidW

crypt32

CryptUnprotectData CryptStringToBinaryA CryptProtectData CryptBinaryToStringA

ws2_32

socket getsockname WSAStartup WSARecv WSASend WSAGetOverlappedResult setsockopt WSAGetLastError WSASocketW closesocket WSADuplicateSocketW

user32

ShowWindow GetWindowPlacement

Name

.text

Size

320KB

Virtual Size

319KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

196KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_451ccd475b4a5cd09176079222620080_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

libcrypto

kernel32

advapi32

crypt32

ws2_32

user32

generic