2026-10-22_0018b6651ec3513105655be7595a0e83_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

General

Target
2026-10-22_0018b6651ec3513105655be7595a0e83_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 4.4MB
Sample261024-3e18saex7j
SHA256 2bbb094bc60f840d598e1691368132d16e4d456a6e52d918187e718e91577359
MD5 0018b6651ec3513105655be7595a0e83
SHA1 cdc627bbd588d00899cf853d66e1e8d18642f3ee
SHA512 1205c7f9630e763741115e79e5d1ee3e6819d98e3a3f7143058bdcfd75ed82ce4b0afe9def791669d7047dd5f841b2ed71c00a0495cc23fe29178d88ff94dbd0
SSDEEP 49152:K/E1Ng53ETTNAilhP3hB/c5KgGR+RvTcv7CWp2C/+Jd:Cb532cKgs67cv2Wp2C/+Jd
TLSH
T158262B12F7660DE2C99380B0CD776B21CB96BC780BF007B76B3246CE697A6D0356A745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_0018b6651ec3513105655be7595a0e83_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-22_0018b6651ec3513105655be7595a0e83_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 4.4MB

2026-10-22_0018b6651ec3513105655be7595a0e83_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH ec888296e48033e2bb6bb1b3f138dd0f
SHA256 2bbb094bc60f840d598e1691368132d16e4d456a6e52d918187e718e91577359
MD5 0018b6651ec3513105655be7595a0e83
SHA1 cdc627bbd588d00899cf853d66e1e8d18642f3ee
SHA512 1205c7f9630e763741115e79e5d1ee3e6819d98e3a3f7143058bdcfd75ed82ce4b0afe9def791669d7047dd5f841b2ed71c00a0495cc23fe29178d88ff94dbd0
SSDEEP 49152:K/E1Ng53ETTNAilhP3hB/c5KgGR+RvTcv7CWp2C/+Jd:Cb532cKgs67cv2Wp2C/+Jd
TLSH
T158262B12F7660DE2C99380B0CD776B21CB96BC780BF007B76B3246CE697A6D0356A745
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

316096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\rel\gpu_drv\r615\r617_07\drivers\nvcamera\redist\_out\wddm2_amd64_release\FreqTransfer64.pdb

kernel32

QueryPerformanceCounter QueryPerformanceFrequency DecodePointer GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection CloseHandle WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive FormatMessageA WideCharToMultiByte MultiByteToWideChar WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx LocalFree GetLocaleInfoEx EncodePointer LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead OutputDebugStringW RaiseException RtlPcToFileHeader RtlUnwindEx SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize CreateFileW WriteConsoleW SetEndOfFile DeleteFileW LocalAlloc lstrlenA ReplaceFileW InitializeCriticalSection DebugBreak ReleaseSemaphore WaitForSingleObject CreateSemaphoreA RtlUnwind

windowscodecs

WICConvertBitmapSource

ole32

CoInitializeEx CoCreateInstance CoUninitialize

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

286B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_0018b6651ec3513105655be7595a0e83_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

windowscodecs

ole32

generic