2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar
Size 5.7MB
Sample261027-lf232azw9j
SHA256 c9c7a6e3a5259695e22262047dc2ea90195effaf5e0e4128427efade6f64c1f8
MD5 ac52f7daf0753c1bcad5ed0f9510f28f
SHA1 5eaee3ad5e4d21b7f0d4c4c132565107515be30b
SHA512 336c0ce805d727fde1920405609baf548fc40bd3a0b972a5cd33a0968525ed586b9ae4441892ed24d53be2ecfe40b0fc14588c566e4d8641fa48868ef18a7981
SSDEEP 98304:un5g2rD2XiuzWzNbhFVj3hOhY5gNppnqAwBYbJzl85w:45joDzm33zOjp6BExR
TLSH
T1D3563304F6E110E7E2B68638878B0642F93BB9060B58ABDB4350F52C2F376962D777D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar

File Explorer

2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar

.exe 5.7MB

2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar

IMPHASH 926764d6509bd768b05964d8c83a70b4
SHA256 c9c7a6e3a5259695e22262047dc2ea90195effaf5e0e4128427efade6f64c1f8
MD5 ac52f7daf0753c1bcad5ed0f9510f28f
SHA1 5eaee3ad5e4d21b7f0d4c4c132565107515be30b
SHA512 336c0ce805d727fde1920405609baf548fc40bd3a0b972a5cd33a0968525ed586b9ae4441892ed24d53be2ecfe40b0fc14588c566e4d8641fa48868ef18a7981
SSDEEP 98304:un5g2rD2XiuzWzNbhFVj3hOhY5gNppnqAwBYbJzl85w:45joDzm33zOjp6BExR
TLSH
T1D3563304F6E110E7E2B68638878B0642F93BB9060B58ABDB4350F52C2F376962D777D1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileType GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcmpW

Name

.text

Size

150KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.8MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_ac52f7daf0753c1bcad5ed0f9510f28f_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar

kernel32

generic