2026-10-26_f0f5c896143e12a5f9d1b471ebdcf5d4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_f0f5c896143e12a5f9d1b471ebdcf5d4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 3.1MB
Sample261027-c591ha1sfs
SHA256 27cf14dd5ac84d4b74fbf31ad063bdf4cc2f19c19c5f55139bde1b73fb1a72a9
MD5 f0f5c896143e12a5f9d1b471ebdcf5d4
SHA1 b595589f9f95006cd32fd0bdba7dc7fe90890129
SHA512 d00b3959b35b969711c0596cce449ff962f18a43d468b6307606904e794c143f29fae04cfb197f7f1955192b40124bc5084560fe573c8afe5189818ad665f6d8
SSDEEP 49152:zYRSAp2sOXQIqusxSDm+zMBJajLQIe6T5jYUCarSj8RoTCCW:z0OS4qGjEIzjlCJTy
TLSH
T121E58D5362A900ECD0ABD07CDA5A9903E7753C0A4370ABDF07D06A562FBBBE15E79710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_f0f5c896143e12a5f9d1b471ebdcf5d4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-26_f0f5c896143e12a5f9d1b471ebdcf5d4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 3.1MB

2026-10-26_f0f5c896143e12a5f9d1b471ebdcf5d4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 8b8b3973b288f2ff07de5e3a453c4197
SHA256 27cf14dd5ac84d4b74fbf31ad063bdf4cc2f19c19c5f55139bde1b73fb1a72a9
MD5 f0f5c896143e12a5f9d1b471ebdcf5d4
SHA1 b595589f9f95006cd32fd0bdba7dc7fe90890129
SHA512 d00b3959b35b969711c0596cce449ff962f18a43d468b6307606904e794c143f29fae04cfb197f7f1955192b40124bc5084560fe573c8afe5189818ad665f6d8
SSDEEP 49152:zYRSAp2sOXQIqusxSDm+zMBJajLQIe6T5jYUCarSj8RoTCCW:z0OS4qGjEIzjlCJTy
TLSH
T121E58D5362A900ECD0ABD07CDA5A9903E7753C0A4370ABDF07D06A562FBBBE15E79710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1497136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Jenkins\workspace\ccd-app\nightly_build\release\6.11\win64\build\msvs_win32_x64\Release\x64\sym\CCHelper\CCHelper\Creative Cloud Helper.pdb

kernel32

WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetModuleFileNameW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetConsoleOutputCP ReadConsoleW GetConsoleMode GetFileType EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetStdHandle ExitProcess GetModuleHandleExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeCriticalSectionAndSpinCount OutputDebugStringW DeleteCriticalSection DecodePointer GetLastError IsDebuggerPresent GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetEnvironmentStringsW InitializeCriticalSectionEx HeapFree GetCurrentProcess LocalAlloc GetVersionExW CreateEventW GlobalFree CloseHandle HeapAlloc GetProcAddress LocalFree VerSetConditionMask GetProcessHeap GetModuleHandleW VerifyVersionInfoW WaitForSingleObject CreateThread GetPhysicallyInstalledSystemMemory LoadLibraryW CreateDirectoryW ReadFile FindFirstFileW GetFileSizeEx FindNextFileW WriteFile DeviceIoControl RemoveDirectoryW GetTempPathW FindClose CreateFileW GetFileAttributesW SetFileAttributesW DeleteFileW MoveFileExW lstrcmpW FlushFileBuffers GetUserDefaultLangID GetUserDefaultUILanguage MultiByteToWideChar FormatMessageW WideCharToMultiByte GetCurrentProcessId SetFilePointer GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSection FreeLibrary FileTimeToSystemTime GetLocalTime GetTimeFormatW SystemTimeToFileTime GetDateFormatW GetTimeZoneInformation Sleep GetFileInformationByHandle CreateMutexW ReleaseMutex OpenMutexW WaitForMultipleObjects SetEvent SetLastError TerminateProcess OpenProcess HeapSize CreateToolhelp32Snapshot ProcessIdToSessionId Process32NextW Process32FirstW HeapReAlloc ResetEvent lstrcmpiW GetExitCodeProcess LoadLibraryA LCMapStringW LCMapStringA GetUserDefaultLCID GetStringTypeExA CreateThreadpool CloseThreadpool CreateThreadpoolCleanupGroup CloseThreadpoolCleanupGroupMembers CloseThreadpoolCleanupGroup CreateThreadpoolTimer SetThreadpoolTimer CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetUserDefaultLocaleName GetVersion GlobalMemoryStatusEx QueryPerformanceFrequency GetNativeSystemInfo LoadLibraryExW GetProcessTimes K32GetProcessMemoryInfo FormatMessageA GetEnvironmentVariableW GetFileAttributesExW GetFileTime SetEndOfFile SetFilePointerEx GetWindowsDirectoryW CreateDirectoryExW AreFileApisANSI InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryEnterCriticalSection GetStringTypeW GetLocaleInfoEx InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW QueryPerformanceCounter InitOnceBeginInitialize InitOnceComplete RtlPcToFileHeader RaiseException WaitForSingleObjectEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime RtlUnwind

user32

TranslateMessage GetMessageW GetSystemMetrics DispatchMessageW PostQuitMessage LoadStringA

shell32

SHGetDiskFreeSpaceExW SHGetFolderPathW SHGetPathFromIDListW ord680 SHGetKnownFolderPath SHGetSpecialFolderPathW SHGetFolderLocation SHCreateDirectoryExW CommandLineToArgvW

ole32

CoCreateGuid StringFromGUID2 CoInitializeEx CoUninitialize CoInitialize CoCreateInstance OleRun CoTaskMemFree CoSetProxyBlanket

crclient

CrashReporterInitialize DisableCRDunamisExitEventCapture SetCRParentWnd ShowCRDialogOnlyOnFirstCrash

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winhttp

WinHttpSetStatusCallback WinHttpSetTimeouts WinHttpSetCredentials WinHttpSendRequest WinHttpConnect WinHttpQueryAuthSchemes WinHttpGetIEProxyConfigForCurrentUser WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpQueryOption WinHttpQueryDataAvailable WinHttpGetProxyForUrl WinHttpCloseHandle

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

shlwapi

PathAddExtensionW PathRemoveExtensionW PathFindFileNameW PathAppendW PathRenameExtensionW PathIsFileSpecW PathRemoveFileSpecW PathFileExistsW PathIsDirectoryW

crypt32

CertGetIssuerCertificateFromStore CertGetNameStringW

iphlpapi

GetAdaptersInfo

advapi32

RegQueryValueExW LookupAccountSidW RegOpenKeyExW RegGetValueW LookupPrivilegeValueW AdjustTokenPrivileges RevertToSelf ConvertStringSidToSidW ImpersonateLoggedOnUser GetUserNameW OpenProcessToken RegSetValueExW RegCreateKeyExW RegCloseKey

oleaut32

GetErrorInfo SysStringLen SysAllocString VariantClear SysFreeString VariantInit VariantChangeType

bcrypt

BCryptDestroyKey BCryptGenerateSymmetricKey BCryptCreateHash BCryptHashData BCryptEncrypt BCryptDecrypt BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptSetProperty BCryptFinishHash BCryptGetProperty BCryptOpenAlgorithmProvider

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

418KB

Virtual Size

417KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

766KB

Virtual Size

768KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_f0f5c896143e12a5f9d1b471ebdcf5d4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

shell32

ole32

crclient

version

winhttp

wtsapi32

shlwapi

crypt32

iphlpapi

advapi32

oleaut32

bcrypt

generic