2026-10-22_70f5f4a81ddcaa9bb1262b4f514774d1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_70f5f4a81ddcaa9bb1262b4f514774d1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 574KB
Sample261024-kzma9aef47
SHA256 5b0821f6661b50c57e3a80bdd8b757d65cbc1b62a4fc4b2a9e18459c79e57125
MD5 70f5f4a81ddcaa9bb1262b4f514774d1
SHA1 e07a18de00d6e016c00b7350d9594a0430bba124
SHA512 128a38a818a5b70029f58068575c7530bb798faf2b3f9c9c697561e6cd02117a6258aa0d4178bdbbddb20a61484f62d8bd40c8021391e715795649c18020156e
SSDEEP 6144:Sd0qf2QXenQMLIO5nkjChWoz9Gjwya0iEWESV1Vpq6+dboALFAgs:Wf2+en5MO5kjoUjwY96/nappAgs
TLSH
T102C41949F26763B4D967F23848168FC6EEA5FC01D770A5EF0246E13A2E167914D38B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-22_70f5f4a81ddcaa9bb1262b4f514774d1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 574KB

2026-10-22_70f5f4a81ddcaa9bb1262b4f514774d1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH ec311518ac9d776f0076c02121b0968b
SHA256 5b0821f6661b50c57e3a80bdd8b757d65cbc1b62a4fc4b2a9e18459c79e57125
MD5 70f5f4a81ddcaa9bb1262b4f514774d1
SHA1 e07a18de00d6e016c00b7350d9594a0430bba124
SHA512 128a38a818a5b70029f58068575c7530bb798faf2b3f9c9c697561e6cd02117a6258aa0d4178bdbbddb20a61484f62d8bd40c8021391e715795649c18020156e
SSDEEP 6144:Sd0qf2QXenQMLIO5nkjChWoz9Gjwya0iEWESV1Vpq6+dboALFAgs:Wf2+en5MO5kjoUjwY96/nappAgs
TLSH
T102C41949F26763B4D967F23848168FC6EEA5FC01D770A5EF0246E13A2E167914D38B32
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

a5:88:3d:d1:06:e6:53:5c:c9:dd:e1:1d:29:b3:f8:ca:25:7f:76:21:3a:0d:5c:ba:d0:24:b1:49:6b:f9:e6:b2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Fishbowl Inventory,O=Fishbowl Inventory,L=Orem,ST=Utah,C=US

Chains

Jun 23, 2026

CN=Fishbowl Inventory,O=Fishbowl Inventory,L=Orem,ST=Utah,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Fishbowl Inventory,O=Fishbowl Inventory,L=Orem,ST=Utah,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Fishbowl Inventory,O=Fishbowl Inventory,L=Orem,ST=Utah,C=US

Serial Number

08:36:6c:7a:68:3e:f6:1d:04:0c:5f:ff:8c:0c:51:d2

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 12, 2023 - Sep 11, 2026

Minor OS version

Major OS version

Entry point

134240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MonitorFromPoint ShowWindow IsWindowVisible IsIconic SetForegroundWindow MessageBoxA ExitWindowsEx GetLastActivePopup GetWindowThreadProcessId EnumWindows MessageBoxW

advapi32

RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorA LookupPrivilegeValueA AdjustTokenPrivileges ConvertSidToStringSidA SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTokenInformation OpenProcessToken RegSetValueExA RegQueryValueExA RegOpenKeyExA RegEnumKeyExA RegCreateKeyExA

ole32

CoUninitialize CoInitializeEx CoCreateInstance GetHGlobalFromStream CreateStreamOnHGlobal

kernel32

GetTimeZoneInformation HeapReAlloc FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetProcessHeap SetStdHandle HeapSize SetEndOfFile EnterCriticalSection OutputDebugStringW ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode EnumSystemLocalesW CreateDirectoryA CreateFileA CreateFileW ReadFile SetFilePointer WriteFile CloseHandle GetLastError GetProcAddress LoadLibraryA GetUserDefaultLCID GetStdHandle FlushFileBuffers GetFileType GetLongPathNameW RemoveDirectoryA ExitProcess WriteConsoleW GetEnvironmentVariableA GetEnvironmentVariableW DeleteFileA FindClose FindFirstFileA FindFirstFileW FindNextFileA GetFullPathNameW GetFullPathNameA GetLongPathNameA GetShortPathNameW GetTempPathW AreFileApisANSI GetTempPathA GetTempFileNameA SetHandleInformation CreatePipe GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW GetWindowsDirectoryA GetWindowsDirectoryW GetModuleFileNameA GetModuleFileNameW GetShortPathNameA FoldStringW MultiByteToWideChar GetEnvironmentStrings GetEnvironmentStringsW FreeEnvironmentStringsA FreeEnvironmentStringsW WaitForSingleObject CreateThread GetExitCodeThread LoadLibraryW GetConsoleOutputCP SetEnvironmentVariableA SetCurrentDirectoryA GetCurrentDirectoryA SearchPathA CreateProcessA GetVersionExA InitializeCriticalSection RtlUnwind LeaveCriticalSection GetSystemTimeAsFileTime GetCommandLineW Sleep GetCurrentProcess LocalAlloc LocalFree CreateMailslotA GetMailslotInfo CreateSemaphoreA LoadResource LockResource SizeofResource GlobalSize GlobalUnlock GlobalLock FindResourceA SetEnvironmentVariableW SetCurrentDirectoryW GetModuleHandleA LoadLibraryExA AllocConsole WideCharToMultiByte IsValidLocale InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentThreadId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateDirectoryW RemoveDirectoryW GetModuleHandleExW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_70f5f4a81ddcaa9bb1262b4f514774d1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

user32

advapi32

ole32

kernel32

generic