2026-10-12_b574913f7715e45e9be32c57f3d7dece_cobalt-strike_icedid_luca-stealer_mimikatz_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-12_b574913f7715e45e9be32c57f3d7dece_cobalt-strike_icedid_luca-stealer_mimikatz_njrat_stealc_vidar
Size 3.4MB
Sample261013-2edxtavsdz
SHA256 58c461ce36d9178018c18ed6e19ddfa2c1485b2abbb5de0be1cb1fb23d71dfbf
MD5 b574913f7715e45e9be32c57f3d7dece
SHA1 2cd278f005d8f4bb0bac1bd5c573f8a65223c347
SHA512 6ce8f1c46f9dd0d9e50a008a0c8e25b23b4ef28ad5053626319f7e33c2e3ed9dc106e54a93fc9ba083667859986f824c1103ab3f1a2d0fd9a2e4c74bd072fdb4
SSDEEP 98304:O9PNk95ghsbMwRl4N9Iv42YWtHoNDTXkf/Lh//BfqY4xpZ:O9PN85HD6N9ILYWt0fkfhJfE
TLSH
T108F51296F7B513F0E1BAC1389962251BF9B1346907709BCF1299865B0F73BE0A93E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-12_b574913f7715e45e9be32c57f3d7dece_cobalt-strike_icedid_luca-stealer_mimikatz_njrat_stealc_vidar

File Explorer

2026-10-12_b574913f7715e45e9be32c57f3d7dece_cobalt-strike_icedid_luca-stealer_mimikatz_njrat_stealc_vidar

.exe 3.4MB

2026-10-12_b574913f7715e45e9be32c57f3d7dece_cobalt-strike_icedid_luca-stealer_mimikatz_njrat_stealc_vidar

IMPHASH 6d601655b304977ba22d9e9cff1fdd6e
SHA256 58c461ce36d9178018c18ed6e19ddfa2c1485b2abbb5de0be1cb1fb23d71dfbf
MD5 b574913f7715e45e9be32c57f3d7dece
SHA1 2cd278f005d8f4bb0bac1bd5c573f8a65223c347
SHA512 6ce8f1c46f9dd0d9e50a008a0c8e25b23b4ef28ad5053626319f7e33c2e3ed9dc106e54a93fc9ba083667859986f824c1103ab3f1a2d0fd9a2e4c74bd072fdb4
SSDEEP 98304:O9PNk95ghsbMwRl4N9Iv42YWtHoNDTXkf/Lh//BfqY4xpZ:O9PN85HD6N9ILYWt0fkfhJfE
TLSH
T108F51296F7B513F0E1BAC1389962251BF9B1346907709BCF1299865B0F73BE0A93E701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

128036

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\YoavShaharabani\source\repos\scenario-generator\x64\Release\CymulateCredsStealNSpread.pdb

kernel32

CreateMutexA WaitForSingleObject CreateFileW ReleaseMutex GetModuleHandleA DisconnectNamedPipe Sleep TerminateThread CreateThread GetProcAddress FlushFileBuffers SizeofResource LockResource LoadResource FindResourceW CreateDirectoryA LoadLibraryW GetComputerNameExW GetLocalTime GetTickCount CancelIo GetQueuedCompletionStatus CreateIoCompletionPort ReadFile GetCurrentProcessId SetErrorMode GetCurrentThread DeleteFileW FreeLibrary GetTickCount64 WriteConsoleW SetEndOfFile ReadConsoleW GetConsoleMode GetConsoleOutputCP GetTempPathW InitializeCriticalSection LeaveCriticalSection GetModuleFileNameW TerminateProcess EnterCriticalSection GetModuleHandleW DeleteCriticalSection LocalFree DecodePointer CloseHandle Process32FirstW CreateFileA Process32NextW GetFileAttributesA GetLastError CreateToolhelp32Snapshot OpenProcess InitializeCriticalSectionEx WriteFile SetFilePointerEx GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapSize HeapReAlloc SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetCurrentProcess GetCommandLineW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetStdHandle GetModuleHandleExW ExitProcess GetModuleFileNameA GetFileType LoadLibraryExW EncodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW

advapi32

GetNamedSecurityInfoW CreateServiceW CloseServiceHandle OpenSCManagerW DeleteService SystemFunction036 StartServiceW CryptDestroyKey CryptGetKeyParam CryptAcquireContextW CryptEncrypt CryptDecrypt CryptSetKeyParam CryptImportKey CryptReleaseContext SetEntriesInAclW SetNamedSecurityInfoW

ole32

CoUninitialize OleRun CoCreateInstance CoCreateInstanceEx CoInitializeEx CoSetProxyBlanket

oleaut32

SysAllocString SysAllocStringByteLen SysStringByteLen SysFreeString VariantInit VariantClear

crypt32

CryptStringToBinaryW

ws2_32

shutdown WSASocketW socket setsockopt WSAGetLastError recv inet_addr htons FreeAddrInfoW gethostbyname closesocket getsockopt __WSAFDIsSet connect inet_ntoa WSAIoctl bind send select WSAStartup getprotobyname WSARecv WSASend getaddrinfo GetAddrInfoW ioctlsocket freeaddrinfo GetNameInfoW

iphlpapi

GetAdaptersInfo GetAdaptersAddresses

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

mpr

WNetAddConnection2W WNetCancelConnection2W

Name

.text

Size

343KB

Virtual Size

343KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

127KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-12_b574913f7715e45e9be32c57f3d7dece_cobalt-strike_icedid_luca-stealer_mimikatz_njrat_stealc_vidar

kernel32

user32

advapi32

ole32

oleaut32

crypt32

ws2_32

iphlpapi

ntdll

mpr

generic