2026-10-26_eedb65a806bd44eb7dccf889995994a1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_eedb65a806bd44eb7dccf889995994a1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1016KB
Sample261027-dfc5xa1tbw
SHA256 f72c2af82822baa5579809e6a5d49a74d601cd9ecfca4115211fbd57aa380664
MD5 eedb65a806bd44eb7dccf889995994a1
SHA1 ae02c7f610f2523beecd1e436fe287524fa81a27
SHA512 b73fffbc2b2e60bc8b110f0eb6d462044fd8031c82ef0a0a9d8b7d1c1db124c1ad0d0a2a9e468bd99bbd253a72789ea7f728705599717ce3b73c128ccc873f19
SSDEEP 6144:sf4aSjsc1Z4LKIS5q+BZJJhs518npBJFStPukWv1hSvwqmqRvznTHq:la6LF5Ffs518npBJFSyfum+vP
TLSH
T19225280662A441E8E0AB92388D53C936E6767C154761D6CB13D4FF7B3E736D09E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_eedb65a806bd44eb7dccf889995994a1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-26_eedb65a806bd44eb7dccf889995994a1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1016KB

2026-10-26_eedb65a806bd44eb7dccf889995994a1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH ed80009a2706b383e20bd44a217304dc
SHA256 f72c2af82822baa5579809e6a5d49a74d601cd9ecfca4115211fbd57aa380664
MD5 eedb65a806bd44eb7dccf889995994a1
SHA1 ae02c7f610f2523beecd1e436fe287524fa81a27
SHA512 b73fffbc2b2e60bc8b110f0eb6d462044fd8031c82ef0a0a9d8b7d1c1db124c1ad0d0a2a9e468bd99bbd253a72789ea7f728705599717ce3b73c128ccc873f19
SSDEEP 6144:sf4aSjsc1Z4LKIS5q+BZJJhs518npBJFStPukWv1hSvwqmqRvznTHq:la6LF5Ffs518npBJFSyfum+vP
TLSH
T19225280662A441E8E0AB92388D53C936E6767C154761D6CB13D4FF7B3E736D09E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1052672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\constructicon\builds\gfx\six\25.10\install\Neoma\InstallNeoma\IN_Apps\Bin\Win64a\B_rel\InstallManagerApp.pdb

xmllite

CreateXmlWriter CreateXmlReader CreateXmlWriterOutputWithEncodingName CreateXmlReaderInputWithEncodingName

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

kernel32

DeleteFileW CloseHandle DecodePointer SetFilePointerEx LocalFree DeleteCriticalSection CreateProcessW CopyFileW LoadLibraryExW GetExitCodeProcess GetWindowsDirectoryW MultiByteToWideChar WideCharToMultiByte FindClose FindNextFileW FlsAlloc GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation HeapReAlloc GetStdHandle ExitProcess GetLastError ProcessIdToSessionId GetSystemDirectoryW CreateFileW LocalAlloc WaitForSingleObject InitializeCriticalSectionEx PeekNamedPipe CreatePipe GetModuleFileNameW WriteFile GetCurrentProcess SetHandleInformation GetFileSizeEx ReadFile GetCurrentProcessId GetLocalTime OutputDebugStringW GetCurrentThreadId GetTempPathW CreateDirectoryW GetModuleHandleW GetProcessHeap GetProcAddress HeapAlloc HeapFree GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFileType GetCommandLineA GetOEMCP GetACP FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind FlsGetValue RtlLookupFunctionEntry RtlCaptureContext IsValidCodePage ReadConsoleW SetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue HeapSize SetEndOfFile WriteConsoleW RtlUnwind GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive RtlPcToFileHeader RaiseException IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW WakeAllConditionVariable SleepConditionVariableSRW InitOnceComplete InitOnceBeginInitialize FindFirstFileExW CompareStringEx EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetCPInfo QueryPerformanceCounter GetSystemTimeAsFileTime

user32

SetForegroundWindow FindWindowW GetForegroundWindow

advapi32

RegCloseKey RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegDeleteKeyValueW OpenProcessToken ConvertSidToStringSidW RegQueryValueExW LookupAccountNameW GetTokenInformation RegQueryInfoKeyW RegEnumValueW

shell32

ShellExecuteW

ole32

CoCreateInstance CoInitialize

setupapi

CM_Get_Device_ID_List_SizeW CM_Get_DevNode_Status CM_Get_DevNode_Registry_PropertyW CM_Reenumerate_DevNode CM_Get_Device_ID_ListW CM_Locate_DevNodeW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

shlwapi

PathFileExistsW

msi

ord88 ord141

netapi32

NetUserGetLocalGroups NetApiBufferFree

wintrust

WinVerifyTrust

imagehlp

ImageGetCertificateData ImageEnumerateCertificates

crypt32

CertGetNameStringW CryptVerifyMessageSignature CertFreeCertificateContext

Name

.text

Size

311KB

Virtual Size

310KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

551KB

Virtual Size

551KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.zero

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_eedb65a806bd44eb7dccf889995994a1_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

xmllite

wtsapi32

kernel32

user32

advapi32

shell32

ole32

setupapi

version

shlwapi

msi

netapi32

wintrust

imagehlp

crypt32

generic