2026-10-11_562e5541566789b6e3f068d59a9c78cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_562e5541566789b6e3f068d59a9c78cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 802KB
Sample261012-z6ebjsft2w
SHA256 eefb2c5f366c51e9176ed88db43c173ac6030d571b09fd7432338576aa1e394f
MD5 562e5541566789b6e3f068d59a9c78cf
SHA1 73f218b4caaa089107d67c842bdad2e39bca1c72
SHA512 71743264977a0f805d8827bc0dff07afa3bd68a7c601b80fd451d63a0fe42af5e37e65e8b28bb1ec5e53efb538768d95ba7c066691f1e223fd30c262dbc0380d
SSDEEP 24576:XXJVmm35zGbJP1X6pvaF06knV7cNetj5Y:XXJV1xkXuaF54RNtj
TLSH
T132058C3A769801F8E0B7D179C8AA5A06F7F1740A1235974F73F9066A2F27B305F2A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing many references to VEEAM. Observed in ransomware 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICOUS_EXE_References_VEEAM

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_562e5541566789b6e3f068d59a9c78cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-11_562e5541566789b6e3f068d59a9c78cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 802KB

2026-10-11_562e5541566789b6e3f068d59a9c78cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 87d8d80669375e1577210539209e83ea
SHA256 eefb2c5f366c51e9176ed88db43c173ac6030d571b09fd7432338576aa1e394f
MD5 562e5541566789b6e3f068d59a9c78cf
SHA1 73f218b4caaa089107d67c842bdad2e39bca1c72
SHA512 71743264977a0f805d8827bc0dff07afa3bd68a7c601b80fd451d63a0fe42af5e37e65e8b28bb1ec5e53efb538768d95ba7c066691f1e223fd30c262dbc0380d
SSDEEP 24576:XXJVmm35zGbJP1X6pvaF06knV7cNetj5Y:XXJV1xkXuaF54RNtj
TLSH
T132058C3A769801F8E0B7D179C8AA5A06F7F1740A1235974F73F9066A2F27B305F2A711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing many references to VEEAM. Observed in ransomware
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

366908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptFinishHash BCryptOpenAlgorithmProvider BCryptGenRandom BCryptCreateHash

ws2_32

gethostname

advapi32

ChangeServiceConfigW AdjustTokenPrivileges CloseServiceHandle RegCloseKey RegQueryValueExA GetUserNameA RegCreateKeyExW RegSetValueExW RegOpenKeyExW QueryServiceStatusEx OpenServiceW LookupPrivilegeValueW CheckTokenMembership EnumServicesStatusExW FreeSid OpenProcessToken EnumDependentServicesW ControlService AllocateAndInitializeSid OpenSCManagerW

user32

SetLayeredWindowAttributes GetAsyncKeyState SetWindowLongW ShowWindow SetWindowPos GetWindowLongW SystemParametersInfoW GetSystemMetrics

shell32

ShellExecuteW CommandLineToArgvW SHChangeNotify SHGetFolderPathW

kernel32

EnumSystemLocalesW HeapReAlloc HeapSize GetTimeZoneInformation GetFileAttributesExW ReadConsoleW GetSystemTimeAsFileTime GetVolumeInformationW IsDebuggerPresent MultiByteToWideChar InitOnceExecuteOnce ReadFile GetFileSizeEx VirtualFree WriteFile VirtualAlloc SetEndOfFile CloseHandle SetFilePointerEx MoveFileExW GetLogicalDrives GetConsoleScreenBufferInfo SetPriorityClass SetConsoleTextAttribute GetCommandLineW GetCurrentProcess GetStdHandle ReleaseSemaphore SetConsoleMode GetConsoleCursorInfo DeviceIoControl GetModuleFileNameW SetThreadPriority CreateMutexW CreateFileW CreateEventW GetConsoleMode GetLastError SetConsoleCursorInfo SetFileInformationByHandle FillConsoleOutputCharacterW GetDiskFreeSpaceExW GetCurrentThread DeleteFileW ResetEvent GetOverlappedResult WriteConsoleW LocalFree ExitProcess GlobalMemoryStatusEx CreateProcessW CreateSemaphoreW CopyFileW SetConsoleCursorPosition GetDriveTypeW SetConsoleScreenBufferSize SetCurrentConsoleFontEx GetTempPathW SetFileAttributesW GetConsoleWindow CreateProcessA lstrcmpiW SetConsoleTitleW GetExitCodeProcess FindFirstFileExW FindFirstVolumeW FindNextFileW lstrlenA FindClose GetFileAttributesW GetSystemInfo SetVolumeMountPointW FindVolumeClose GetVolumePathNamesForVolumeNameW FindNextVolumeW HeapAlloc GetLogicalDriveStringsA GetProcAddress GetProcessHeap GetModuleHandleW WideCharToMultiByte GetComputerNameExA GetDiskFreeSpaceExA GetComputerNameA FlsFree GetUserDefaultLCID IsValidLocale FlsSetValue FlsGetValue FlsAlloc LCMapStringEx DecodePointer EncodePointer SleepConditionVariableSRW SleepConditionVariableCS SetStdHandle SetEnvironmentVariableW GetLocaleInfoW FreeEnvironmentStringsW GetEnvironmentStringsW IsValidCodePage WaitForSingleObject GetACP WakeAllConditionVariable WakeConditionVariable LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetFileType HeapFree GetConsoleOutputCP FlushFileBuffers GetCommandLineA FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException InitializeSListHead GetCurrentProcessId GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx GetLocaleInfoEx GetOEMCP GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId WaitForSingleObjectEx Sleep GetExitCodeThread InitializeConditionVariable

shlwapi

StrStrIW PathAppendW

dwmapi

DwmSetWindowAttribute

winhttp

WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpReceiveResponse WinHttpOpenRequest WinHttpCrackUrl WinHttpOpen

pdh

PdhOpenQueryW PdhAddCounterW PdhGetFormattedCounterValue PdhCollectQueryData PdhCloseQuery

iphlpapi

GetIfTable GetAdaptersInfo

mpr

WNetGetUniversalNameW

gdiplus

GdipCreateFontFamilyFromName GdipCloneImage GdipDeleteBrush GdipAlloc GdipDisposeImage GdipSetSmoothingMode GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipDeleteFontFamily GdipFree GdipDrawString GdipDrawRectangleI GdipGetImageGraphicsContext GdipFillRectangleI GdipGetImageEncodersSize GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipDeletePen GdipCreateBitmapFromScan0 GdipCreatePen1 GdipSetStringFormatAlign GdipSaveImageToFile GdipCreateStringFormat GdipCloneBrush GdipGetImageEncoders GdiplusShutdown GdiplusStartup GdipGetGenericFontFamilySansSerif

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx RtlPcToFileHeader RtlUnwind

Name

.text

Size

571KB

Virtual Size

570KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

194KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_562e5541566789b6e3f068d59a9c78cf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

bcrypt

ws2_32

advapi32

user32

shell32

kernel32

shlwapi

dwmapi

winhttp

pdh

iphlpapi

mpr

gdiplus

ntdll

generic