2026-10-26_568c668f00f2eef73e75fce48894ff4e_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_568c668f00f2eef73e75fce48894ff4e_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 3.7MB
Sample261027-vkhpmaex5x
SHA256 16d57df1ac9d5ad81a197e102ac3b343233d2d3914be43c57edbb81c4c19b749
MD5 568c668f00f2eef73e75fce48894ff4e
SHA1 e3617bf454f2375b740fe06864eaf6f4dff906c9
SHA512 76ae93a4a05655d89103d18ab35d39d538c429582e9b495b48389d7de4cd16bf32413b1f5cc494c52eab5338cee225caec7ca52cc79f310d624880bc65674159
SSDEEP 49152:Z8uw0VOrL8hF+ess1wH9IlH3n3DdwCTLli++8IPuDiTnRIYUVarSj8RoTCCrLNiI:Z8XRydz5icIPolVJTn7wRGpj3
TLSH
T1A406BE5762E801D5E1F6D13C8A67850AE6723C160335A7DF12B06A5E2F77BE08EBE710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_568c668f00f2eef73e75fce48894ff4e_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-10-26_568c668f00f2eef73e75fce48894ff4e_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 3.7MB

2026-10-26_568c668f00f2eef73e75fce48894ff4e_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH b24c321b42878c5f8ea1892c583ab826
SHA256 16d57df1ac9d5ad81a197e102ac3b343233d2d3914be43c57edbb81c4c19b749
MD5 568c668f00f2eef73e75fce48894ff4e
SHA1 e3617bf454f2375b740fe06864eaf6f4dff906c9
SHA512 76ae93a4a05655d89103d18ab35d39d538c429582e9b495b48389d7de4cd16bf32413b1f5cc494c52eab5338cee225caec7ca52cc79f310d624880bc65674159
SSDEEP 49152:Z8uw0VOrL8hF+ess1wH9IlH3n3DdwCTLli++8IPuDiTnRIYUVarSj8RoTCCrLNiI:Z8XRydz5icIPolVJTn7wRGpj3
TLSH
T1A406BE5762E801D5E1F6D13C8A67850AE6723C160335A7DF12B06A5E2F77BE08EBE710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1396160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Jenkins\workspace\ccd-app\nightly_build\release\6.11\win64\build\msvs_win32_x64\Release\x64\sym\CreativeCloud\CreativeCloud\Creative Cloud.pdb

kernel32

CreateEventW SetEvent SetDllDirectoryW AddDllDirectory SetDefaultDllDirectories FindResourceW LoadResource LockResource SizeofResource InitializeCriticalSection LeaveCriticalSection EnterCriticalSection WideCharToMultiByte SetErrorMode FreeLibrary CreateProcessW GetProcAddress LoadLibraryW CloseHandle Process32FirstW DeleteFileW Process32NextW Sleep MultiByteToWideChar CreateToolhelp32Snapshot SetFileAttributesW OpenProcess WaitForSingleObject FindClose CopyFileW GetCommandLineW GetTempPathW RemoveDirectoryW TerminateProcess FindNextFileW FindFirstFileW AcquireSRWLockShared RaiseException ReleaseSRWLockShared WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage AcquireSRWLockExclusive ReadConsoleW GetConsoleMode GetFileType EnumSystemLocalesW IsValidLocale ReleaseSRWLockExclusive EncodePointer GetModuleFileNameW GetPackageFamilyName GetCurrentProcess GetLocaleInfoW CompareStringW GetStdHandle GetTimeZoneInformation ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwindEx InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext OutputDebugStringW IsDebuggerPresent GetCPInfo LCMapStringEx FlsFree FlsSetValue FlsGetValue FlsAlloc TryAcquireSRWLockShared GetFileInformationByHandleEx AreFileApisANSI GetFileAttributesExW FindFirstFileExW GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable InitializeSRWLock RtlPcToFileHeader GetStringTypeW QueryPerformanceFrequency QueryPerformanceCounter GetExitCodeThread WaitForSingleObjectEx LoadLibraryExW SetThreadPriority InitOnceExecuteOnce GetModuleHandleW DeleteCriticalSection DecodePointer GetLastError InitializeCriticalSectionEx GetConsoleOutputCP lstrlenW SetLastError FormatMessageA InitializeCriticalSectionAndSpinCount TryEnterCriticalSection GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetCurrentProcessId WriteFile SetFilePointer CreateFileW GetCurrentThreadId lstrcmpW CreateDirectoryW ReadFile GetFileSizeEx LocalAlloc GetFileAttributesW LocalFree MoveFileExW FlushFileBuffers TerminateThread CreateThread HeapFree GetVersionExW GetCurrentThread GlobalFree HeapAlloc VerSetConditionMask GetProcessHeap VerifyVersionInfoW GetFileInformationByHandle HeapSize ProcessIdToSessionId HeapReAlloc ResetEvent QueryFullProcessImageNameW lstrcmpiW FileTimeToSystemTime GetLocalTime GetTimeFormatW SystemTimeToFileTime GetDateFormatW CreateMutexW ReleaseMutex OpenMutexW GetUserDefaultLangID GetUserDefaultUILanguage ReleaseSemaphore OpenSemaphoreW CreateSemaphoreW LCMapStringW GetUserDefaultLCID SetEndOfFile SetFilePointerEx ResumeThread GetSystemTimeAsFileTime RtlUnwind

user32

IsWindowVisible GetFocus BringWindowToTop SetWindowTextW SendMessageW PostMessageW DialogBoxParamW GetDlgItem ShowWindow EndDialog SystemParametersInfoW LoadImageW PostQuitMessage RegisterClassW GetSystemMetrics CreateWindowExW DestroyWindow DefWindowProcW ReleaseDC GetMonitorInfoW MonitorFromWindow GetDC GetForegroundWindow GetAncestor GetDesktopWindow

gdi32

GetDeviceCaps

advapi32

RevertToSelf ConvertStringSidToSidW ImpersonateLoggedOnUser ConvertSidToStringSidW GetUserNameW SetSecurityDescriptorDacl RegCloseKey AllocateAndInitializeSid LookupAccountSidW GetNamedSecurityInfoW FreeSid LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegSetKeyValueW SetNamedSecurityInfoW CreateWellKnownSid SetEntriesInAclW InitializeSecurityDescriptor GetTokenInformation RegQueryValueExW RegOpenKeyExW

shell32

ord680 SHGetFolderLocation SHGetPathFromIDListW Shell_NotifyIconW SHCreateDirectoryExW SHGetSpecialFolderPathW SHCreateItemFromParsingName CommandLineToArgvW SHGetKnownFolderPath ShellExecuteW SHGetFolderPathW ord51

ole32

OleRun CLSIDFromString CoInitialize CLSIDFromProgID CoInitializeEx CoCreateInstance CoUninitialize StringFromGUID2 CoRevokeClassObject CoResumeClassObjects CoRegisterClassObject CoTaskMemFree StringFromCLSID CoReleaseServerProcess CoAddRefServerProcess CoCreateGuid

crclient

DisableCRDunamisExitEventCapture CrashReporterInitialize ShowCRDialogOnlyOnFirstCrash SetCRParentWnd

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference WindowsIsStringEmpty WindowsCreateString WindowsStringHasEmbeddedNull WindowsDeleteString WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoActivateInstance RoGetActivationFactory RoRevokeActivationFactories RoInitialize RoUninitialize RoRegisterActivationFactories

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW RoOriginateError

credui

CredUIPromptForCredentialsW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

InternetCanonicalizeUrlW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW

winhttp

WinHttpGetIEProxyConfigForCurrentUser WinHttpQueryAuthSchemes WinHttpGetProxyForUrl WinHttpCloseHandle WinHttpSetCredentials WinHttpSetOption WinHttpSetTimeouts WinHttpOpen WinHttpOpenRequest WinHttpReadData WinHttpConnect WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest

shlwapi

PathFileExistsW PathIsDirectoryW PathRenameExtensionW PathIsFileSpecW PathAddExtensionW PathFindFileNameW PathRemoveFileSpecW PathRemoveExtensionW PathIsRootW UrlIsW PathAppendW PathIsSystemFolderW

dwmapi

DwmSetWindowAttribute

wintrust

WinVerifyTrust

crypt32

CryptMsgClose CertGetNameStringW CertFreeCertificateContext CryptQueryObject CertCloseStore CryptMsgGetParam CertFindCertificateInStore

oleaut32

VariantClear VariantChangeType SysAllocString SysFreeString VariantInit VariantCopy GetErrorInfo

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

465KB

Virtual Size

465KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

37KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

360B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

216KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_568c668f00f2eef73e75fce48894ff4e_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

kernel32

user32

gdi32

advapi32

shell32

ole32

crclient

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

credui

version

wininet

wtsapi32

winhttp

shlwapi

dwmapi

wintrust

crypt32

oleaut32

generic