2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar
Size 2.7MB
Sample261017-hasevsay3l
SHA256 9443d295b8ac775fc45ee8e8debb23797f45ef9a4e92bbc95bdc2f3432afa3ff
MD5 ceb74b0c2b77f3598bf28ecfff9f2f90
SHA1 d5d9a5fbce02ff7fe38ab7770eb3137dc2bd59d5
SHA512 3820db3298702f56295b9ecd84d24afd061823252459aeef12e53e878134f1f921dc3d01f5f4fff016d04609dc2863f8e5e57f7deea4fce7ef32f7e335c1351e
SSDEEP 49152:N09W83G9pyW04ZX4CaEucW/RrmpGarSj8RoTCCRCaEucW/Rrmp:Nw3290gTnudRSpGJT0nudRSp
TLSH
T107D5E02EE69841A6F06AA235EC554706E7B33F15137186CF32A076691F776E08F3EE10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar

File Explorer

2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar

.exe 2.7MB

2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar

IMPHASH 0952fc8422e9df4737b41086c55c43d8
SHA256 9443d295b8ac775fc45ee8e8debb23797f45ef9a4e92bbc95bdc2f3432afa3ff
MD5 ceb74b0c2b77f3598bf28ecfff9f2f90
SHA1 d5d9a5fbce02ff7fe38ab7770eb3137dc2bd59d5
SHA512 3820db3298702f56295b9ecd84d24afd061823252459aeef12e53e878134f1f921dc3d01f5f4fff016d04609dc2863f8e5e57f7deea4fce7ef32f7e335c1351e
SSDEEP 49152:N09W83G9pyW04ZX4CaEucW/RrmpGarSj8RoTCCRCaEucW/Rrmp:Nw3290gTnudRSpGJT0nudRSp
TLSH
T107D5E02EE69841A6F06AA235EC554706E7B33F15137186CF32A076691F776E08F3EE10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

234640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

FCAT_DT_Capture_x64.pdb

kernel32

GetModuleFileNameA SetLastError GetFullPathNameW GetModuleFileNameW LocalAlloc CreateFileW GetFileAttributesW GetSystemDirectoryW GetLastError CloseHandle GetProcAddress LocalFree VerSetConditionMask CreateProcessW GetModuleHandleW FreeLibrary VerifyVersionInfoW LoadLibraryExW CreateDirectoryW SetConsoleCtrlHandler EnterCriticalSection GetCommandLineW SetConsoleTitleA GetCurrentProcess RegisterWaitForSingleObject UnregisterWait OutputDebugStringA LeaveCriticalSection InitializeCriticalSection WaitForSingleObject GetCurrentThreadId FindFirstChangeNotificationW CreateEventW Sleep AttachConsole OutputDebugStringW SetEvent FindCloseChangeNotification QueryPerformanceFrequency ResetEvent GetLocalTime FindNextChangeNotification DeleteCriticalSection GetCurrentProcessId lstrcmpiW QueryPerformanceCounter AllocConsole HeapFree SetDefaultDllDirectories CreateMutexW GetCurrentDirectoryA UnmapViewOfFile SetProcessMitigationPolicy CreateThread HeapAlloc CreateFileMappingA GetProcessHeap lstrcpyW OpenFileMappingA MapViewOfFile MulDiv WritePrivateProfileStringW GetPrivateProfileIntW LoadLibraryExA GetPrivateProfileStringW WaitForMultipleObjects OpenProcess CopyFileW FormatMessageA CreateEventA SetEndOfFile WriteConsoleW HeapSize GetTimeZoneInformation HeapReAlloc SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadFile ReadConsoleW PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleMode SetFilePointerEx RaiseException GetSystemInfo VirtualProtect VirtualQuery RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead MultiByteToWideChar GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI MoveFileExW GetFileInformationByHandleEx WideCharToMultiByte GetStringTypeW TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo RtlUnwindEx RtlPcToFileHeader InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetConsoleCP ExitProcess GetStdHandle WriteFile GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx RtlUnwind

ole32

CoTaskMemFree

shlwapi

PathFileExistsW

bcrypt

BCryptImportKeyPair BCryptVerifySignature BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyKey

Name

.text

Size

569KB

Virtual Size

569KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_ceb74b0c2b77f3598bf28ecfff9f2f90_cobalt-strike_icedid_luca-stealer_njrat_vidar

kernel32

ole32

shlwapi

bcrypt

generic