vorishka_stealer | 2026-10-16_6ae4c93975a1bb43a6a5c9de182f80fb_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_6ae4c93975a1bb43a6a5c9de182f80fb_cobalt-strike_icedid_njrat_satacom_stealc
Size 1.1MB
Sample261017-sr7k8awsbx
SHA256 a1ed70e9cb1ac34de80d144451878d3c7b75c5b2485d6c2f2ffe32c0ad4ffbc9
MD5 6ae4c93975a1bb43a6a5c9de182f80fb
SHA1 1eed6507b67d896d34b38c17174cf2c4932cb41e
SHA512 a9f7e4c4b2fc65c211655b8f61276b292c79823e1a7a21c731df913d1d212b671c8fa6b5d41b95cd7da5e0aa0483b35fb38fe8d9b4469b1cf0379cfb58275c0f
SSDEEP 24576:eZQqfYMmMKsmsCMmMaMmMCsmswVMmMCsms8+5glCvQ4c0rRPY1Nsz:9MN+1
TLSH
T18A357E26B16C41E4D167D2788DA60506E7F2BC4513319FDF43A09EA61F27AF0AE7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer vorishka_stealer

Malware Config

Extracted

Family

vorishka_stealer

45.115.27.4:12345

Signatures

Family: VorishkaStealer
VorishkaStealer is a Windows stealer written in C++.
stealer vorishka_stealer

Detects VorishkaStealer 1 IoCs

resource	yara_rule
sample	family_vorishkastealer

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_6ae4c93975a1bb43a6a5c9de182f80fb_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-10-16_6ae4c93975a1bb43a6a5c9de182f80fb_cobalt-strike_icedid_njrat_satacom_stealc

.exe 1.1MB

2026-10-16_6ae4c93975a1bb43a6a5c9de182f80fb_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 38e6f1d34b0edf776d99e79a047fe9cd
SHA256 a1ed70e9cb1ac34de80d144451878d3c7b75c5b2485d6c2f2ffe32c0ad4ffbc9
MD5 6ae4c93975a1bb43a6a5c9de182f80fb
SHA1 1eed6507b67d896d34b38c17174cf2c4932cb41e
SHA512 a9f7e4c4b2fc65c211655b8f61276b292c79823e1a7a21c731df913d1d212b671c8fa6b5d41b95cd7da5e0aa0483b35fb38fe8d9b4469b1cf0379cfb58275c0f
SSDEEP 24576:eZQqfYMmMKsmsCMmMaMmMCsmswVMmMCsms8+5glCvQ4c0rRPY1Nsz:9MN+1
TLSH
T18A357E26B16C41E4D167D2788DA60506E7F2BC4513319FDF43A09EA61F27AF0AE7E720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects VorishkaStealer
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

638304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\AppData\Local\Temp\2\b697bbc9-41c8-4da1-86a8-506b40d5b5a6\Vorishka.pdb

kernel32

CopyFileExW SizeofResource ExpandEnvironmentStringsW EnumResourceNamesW GetTempPathW EndUpdateResourceW LockResource DeleteFileW EnumResourceLanguagesW FindResourceExW LoadResource UpdateResourceW MoveFileExW FreeLibrary BeginUpdateResourceW GetTempFileNameW LoadLibraryExW SetLastError GetFileAttributesA GetLogicalDrives GetSystemDefaultLocaleName GetLastError GlobalMemoryStatusEx WideCharToMultiByte GetComputerNameA RemoveDirectoryW SetFileAttributesW CreateDirectoryA GetEnvironmentVariableW WriteProcessMemory ResumeThread Sleep GetThreadContext CreateDirectoryW ReadProcessMemory CreateProcessW VirtualFreeEx SetThreadContext FormatMessageA CreateProcessA SetEndOfFile WriteConsoleW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP CreateFileW WriteFile FindFirstFileExW GetFileSizeEx GetSystemInfo ReadFile GetExitCodeProcess CloseHandle OpenProcess WaitForSingleObject TerminateProcess GetCurrentProcess LocalFree GetFileAttributesW FindClose FindNextFileW IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetTimeZoneInformation GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect HeapQueryInformation HeapSize UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext VirtualAllocEx FindFirstFileW HeapReAlloc HeapAlloc HeapFree GetStdHandle GetModuleFileNameW GetProcAddress ExitProcess IsProcessorFeaturePresent FreeLibraryAndExitThread RtlUnwind ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns RaiseException MultiByteToWideChar WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread GetLogicalProcessorInformationEx QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive RtlPcToFileHeader

user32

EnumDisplayDevicesW GetMonitorInfoW EnumDisplayMonitors GetDC ReleaseDC

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteDC DeleteObject BitBlt

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA CryptAcquireContextA CryptGenRandom RegEnumKeyExW RegOpenKeyExW RegQueryValueExW CryptReleaseContext

shell32

SHGetKnownFolderPath ShellExecuteW SHGetFolderPathW

ole32

CoSetProxyBlanket CoUninitialize CoTaskMemFree CoCreateInstance CoInitializeEx

oleaut32

SysFreeString VariantClear SysAllocString VariantInit

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptDecrypt BCryptGenerateSymmetricKey BCryptDestroyKey

shlwapi

PathFindExtensionW

crypt32

CryptUnprotectData

rpcrt4

UuidCreate UuidToStringW RpcStringFreeW

rstrtmgr

RmStartSession RmGetList RmRegisterResources RmEndSession

winhttp

WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse WinHttpConnect WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpReadData

gdiplus

GdiplusShutdown GdiplusStartup GdipSaveImageToFile GdipGetImageEncoders GdipCloneImage GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipFree GdipAlloc GdipDisposeImage

ws2_32

ioctlsocket htons connect socket send setsockopt shutdown WSACleanup closesocket select WSAGetLastError inet_pton WSAStartup

Name

.text

Size

830KB

Virtual Size

829KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

40KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-10-16_6ae4c93975a1bb43a6a5c9de182f80fb_cobalt-strike_icedid_njrat_satacom_stealc

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

bcrypt

shlwapi

crypt32

rpcrt4

rstrtmgr

winhttp

gdiplus

ws2_32

generic