2026-10-22_0033e9f259b6b9ed4c57f229e59124e4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_0033e9f259b6b9ed4c57f229e59124e4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 3.0MB
Sample261024-3ebccssx3r
SHA256 765d5c20f931a2b849766767e2d19cb393fc6c5fdec5e82b2333930d98111b00
MD5 0033e9f259b6b9ed4c57f229e59124e4
SHA1 de55bd465b95e73bd74d0b2bea06ce2708f2f0cc
SHA512 aa229365f240a384c6465351002af57627c7ed05f084798effe95e7d80f59ff7f47ecb76eff292f2bd5cb6f624b35e390d3cebdc710d7e2ff8730569fad56297
SSDEEP 49152:dD6afH5YY6LppyNjzXv0ASr61lXMDS6j6HlM8zTx0ZJMe9ScLNiXicJFFRGNzj3:Nm+b86HO0x0ZPl7wRGpj3
TLSH
T176E57D1766FA02B8E0BFD1788E274902E676780543329EDF17D045961F77BE18E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_0033e9f259b6b9ed4c57f229e59124e4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-22_0033e9f259b6b9ed4c57f229e59124e4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 3.0MB

2026-10-22_0033e9f259b6b9ed4c57f229e59124e4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 874b76673caf87b90419ee2adeb5daca
SHA256 765d5c20f931a2b849766767e2d19cb393fc6c5fdec5e82b2333930d98111b00
MD5 0033e9f259b6b9ed4c57f229e59124e4
SHA1 de55bd465b95e73bd74d0b2bea06ce2708f2f0cc
SHA512 aa229365f240a384c6465351002af57627c7ed05f084798effe95e7d80f59ff7f47ecb76eff292f2bd5cb6f624b35e390d3cebdc710d7e2ff8730569fad56297
SSDEEP 49152:dD6afH5YY6LppyNjzXv0ASr61lXMDS6j6HlM8zTx0ZJMe9ScLNiXicJFFRGNzj3:Nm+b86HO0x0ZPl7wRGpj3
TLSH
T176E57D1766FA02B8E0BFD1788E274902E676780543329EDF17D045961F77BE18E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1547464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\DAX37_sign\dax3\API\output\Release\x64\DAX3API.pdb

api-ms-win-core-string-l1-1-0

GetStringTypeW CompareStringEx WideCharToMultiByte MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-0

GetLastError RaiseException SetUnhandledExceptionFilter UnhandledExceptionFilter SetLastError

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid DuplicateTokenEx GetTokenInformation

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-core-localization-l1-2-0

GetACP IsValidCodePage GetCPInfo FormatMessageA GetLocaleInfoEx GetUserDefaultLCID IsValidLocale LCMapStringEx GetLocaleInfoW LCMapStringW GetOEMCP EnumSystemLocalesW FormatMessageW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW RegSetValueExW RegOpenKeyExW RegQueryInfoKeyW RegCreateKeyExW RegNotifyChangeKeyValue RegGetValueW RegCloseKey RegEnumKeyExW RegDeleteValueW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertSidToStringSidW

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

ExitThread OpenProcessToken CreateThread GetCurrentThreadId TlsFree ExitProcess TlsSetValue TlsGetValue TerminateProcess TlsAlloc GetStartupInfoW CreateProcessAsUserW GetCurrentProcess GetExitCodeThread GetCurrentProcessId

api-ms-win-core-processthreads-l1-1-1

OpenProcess IsProcessorFeaturePresent

api-ms-win-core-memory-l1-1-0

OpenFileMappingW CreateFileMappingW MapViewOfFile UnmapViewOfFile VirtualFree

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW FreeLibraryAndExitThread LoadLibraryExW LoadResource SizeofResource LockResource FreeLibrary GetModuleHandleW GetModuleFileNameW GetProcAddress GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx ReleaseSemaphore SetEvent CreateEventW InitializeCriticalSectionAndSpinCount OpenMutexW InitializeSRWLock ReleaseMutex ReleaseSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSection OpenEventW AcquireSRWLockExclusive TryAcquireSRWLockExclusive ResetEvent WaitForSingleObject InitializeCriticalSectionEx DeleteCriticalSection CreateMutexW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount64

api-ms-win-core-com-l1-1-0

CoTaskMemRealloc CoTaskMemAlloc CoCreateGuid CoInitializeEx CoSetProxyBlanket CoCreateInstance CoCreateFreeThreadedMarshaler CoUninitialize StringFromGUID2 PropVariantClear CoTaskMemFree

rpcrt4

RpcEpRegisterW RpcBindingVectorFree RpcServerInqBindings RpcServerListen RpcServerRegisterIf3 NdrClientCall3 NdrServerCallAll NdrServerCall2 RpcServerUnregisterIf RpcServerUseProtseqEpW RpcMgmtStopServerListening RpcEpUnregister

oleaut32

VarBstrCmp SafeArrayUnaccessData SafeArrayAccessData SysStringByteLen SafeArrayUnlock SafeArrayLock SafeArrayGetLBound SafeArrayGetUBound SafeArrayRedim SafeArrayDestroy VarUI4FromStr SafeArrayPutElement SetErrorInfo GetErrorInfo VariantClear VariantInit SysAllocStringByteLen BSTR_UserSize BSTR_UserMarshal BSTR_UserUnmarshal BSTR_UserFree BSTR_UserSize64 BSTR_UserMarshal64 BSTR_UserUnmarshal64 BSTR_UserFree64 LPSAFEARRAY_UserSize LPSAFEARRAY_UserMarshal LPSAFEARRAY_UserUnmarshal SafeArrayCreate LPSAFEARRAY_UserSize64 LPSAFEARRAY_UserMarshal64 LPSAFEARRAY_UserUnmarshal64 LPSAFEARRAY_UserFree64 SysStringLen SafeArrayGetElemsize SafeArrayCreateVector SafeArrayCopyData LPSAFEARRAY_UserFree SysFreeString SysAllocString

propsys

PropVariantToStringWithDefault PropVariantGetElementCount PropVariantGetStringElem InitPropVariantFromBuffer InitPropVariantFromInt32Vector InitPropVariantFromCLSID PropVariantCompareEx

api-ms-win-devices-config-l1-1-1

CM_Locate_DevNodeW CM_Get_DevNode_PropertyW

mf

MFEnumDeviceSources

mfplat

MFCreateAttributes

api-ms-win-core-libraryloader-l1-2-1

FindResourceW LoadLibraryW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-localization-obsolete-l1-2-0

GetUserDefaultUILanguage

api-ms-win-core-debug-l1-1-0

DebugBreak OutputDebugStringW IsDebuggerPresent

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-service-management-l1-1-0

DeleteService CreateServiceW OpenSCManagerW CloseServiceHandle OpenServiceW

api-ms-win-core-file-l1-1-0

GetFileType FlushFileBuffers GetFileAttributesExW WriteFile CreateDirectoryW CreateFileW SetEndOfFile ReadFile SetFileInformationByHandle GetFileSizeEx FindClose SetFilePointerEx FindFirstFileW DeleteFileW FindFirstFileExW GetShortPathNameW FindNextFileW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-core-threadpool-l1-2-0

SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CreateThreadpoolWork CloseThreadpoolWork

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus ControlService

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

user32

UnregisterPowerSettingNotification RegisterPowerSettingNotification

ole32

CoInitialize

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

dax3dapcontrol

GetDapParam OpenDapControl CloseDapControl SetDapVariantParam

daxssid

GetSystemHardwareId GetSSID ClearSSID

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsW

rtworkq

RtwqCreateAsyncResult RtwqPutWorkItem

cfgmgr32

CM_Get_Device_ID_ListW CM_Get_Device_ID_List_SizeW CM_Get_Device_Interface_ListW CM_Get_Device_Interface_PropertyW CM_Open_DevNode_Key CM_Get_Device_Interface_List_SizeW

crypt32

CryptMsgClose CertFindCertificateInStore CertCloseStore CertFreeCertificateContext CertGetNameStringW CryptMsgGetParam CryptQueryObject

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW SetStdHandle ExpandEnvironmentStringsW GetCommandLineA GetStdHandle GetEnvironmentStringsW GetCommandLineW

api-ms-win-core-kernel32-legacy-l1-1-0

PulseEvent WTSGetActiveConsoleSessionId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter QueryPerformanceFrequency

api-ms-win-eventing-provider-l1-1-0

EventRegister EventUnregister EventWriteString

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-fibers-l1-1-0

FlsAlloc FlsGetValue FlsFree FlsSetValue

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlCaptureContext RtlUnwind RtlUnwindEx RtlPcToFileHeader RtlLookupFunctionEntry

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InitializeSListHead

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP GetConsoleMode ReadConsoleW WriteConsoleW

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

497KB

Virtual Size

496KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

59KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_0033e9f259b6b9ed4c57f229e59124e4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-com-l1-1-0

rpcrt4

oleaut32

propsys

api-ms-win-devices-config-l1-1-1

mf

mfplat

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-file-l2-1-2

api-ms-win-security-base-l1-2-2

api-ms-win-core-threadpool-l1-2-0

api-ms-win-service-core-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-util-l1-1-0

user32

ole32

wtsapi32

dax3dapcontrol

daxssid

version

avrt

rtworkq

cfgmgr32

crypt32

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-file-l2-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-console-l1-1-0

generic