2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

General

Target
2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.6MB
Sample261017-ehgrjsda44
SHA256 c4aa7a168aa30297dcfb50db340c4972cd9d6f8ed92a2c9fedea686bfdefdb53
MD5 e97bd205b918b539f7953c9ac20823f2
SHA1 74831b0af96cb30a8eb46a7196c25c4575b33ee7
SHA512 bd9f1d832ad89b08e496fd96d496d0d560f635e339db8f4563326670e2568a0c00d09b46a800510a73af814fe7f0531e486d1568ee3dc4e506188fb226963da6
SSDEEP 24576:rbdlZPzOFfSndwE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vdlZifSdLNiXicJFFRGNzj3
TLSH
T14475BF10169F0CABD897F13D8A618D4BD1F27C144B26C6AB66A02D1A7FB778369353C3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.6MB

2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 42fd227b3054f4255916ffd210a51034
SHA256 c4aa7a168aa30297dcfb50db340c4972cd9d6f8ed92a2c9fedea686bfdefdb53
MD5 e97bd205b918b539f7953c9ac20823f2
SHA1 74831b0af96cb30a8eb46a7196c25c4575b33ee7
SHA512 bd9f1d832ad89b08e496fd96d496d0d560f635e339db8f4563326670e2568a0c00d09b46a800510a73af814fe7f0531e486d1568ee3dc4e506188fb226963da6
SSDEEP 24576:rbdlZPzOFfSndwE/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:vdlZifSdLNiXicJFFRGNzj3
TLSH
T14475BF10169F0CABD897F13D8A618D4BD1F27C144B26C6AB66A02D1A7FB778369353C3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

54976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\gcomp\rel\src\ApplicationOntology\build\bin\x64\Release\NvOAWrapperCache.pdb

kernel32

ReadFile WriteFile CreateNamedPipeW WaitForMultipleObjects OpenEventW DisconnectNamedPipe CreateEventW Sleep GetLastError SetEvent CloseHandle ResetEvent ConnectNamedPipe FlushFileBuffers OutputDebugStringW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FreeLibrary GetModuleHandleW GetProcAddress VerSetConditionMask CreateFileW GetFileAttributesW GetFullPathNameW SetLastError GetSystemDirectoryW GetModuleFileNameA GetModuleFileNameW LoadLibraryExW LocalAlloc LocalFree VerifyVersionInfoW WriteConsoleW MultiByteToWideChar WideCharToMultiByte GetStringTypeW InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle ExitProcess GetModuleHandleExW HeapAlloc HeapFree GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap SetFilePointerEx HeapSize GetConsoleOutputCP GetConsoleMode

Name

.text

Size

170KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

640B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

147KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_e97bd205b918b539f7953c9ac20823f2_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

generic