2026-10-28_a514a904a0e14d1690ba6c132172b542_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_a514a904a0e14d1690ba6c132172b542_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar
Size 4.6MB
Sample261029-1rc1lsfs2s
SHA256 b0197a98fbcd2ed7bb7612209740bb19d6d199ca1f795305d96dcd2dee977dd0
MD5 a514a904a0e14d1690ba6c132172b542
SHA1 488b7b741e2f600969c8a79ba8e9ba5d8194276d
SHA512 c5d91ea265b6414568f4e52cb329e99dc1660273b2731b235a4dacd53f166a7e1058dfa6473f582e81832b444ae80866517f22d4ca91882005b923c73ee3ac50
SSDEEP 98304:Zn/+2rD2XiuzWzNbhFVj3hOhY5gNppnqf3b2:Z/BoDzm33zOjp8
TLSH
T17D263304F6D496FAE1B68639C26A0501F336BD015B0DB7CF4264E1A82E377CA1973BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_a514a904a0e14d1690ba6c132172b542_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar

File Explorer

2026-10-28_a514a904a0e14d1690ba6c132172b542_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar

.exe 4.6MB

2026-10-28_a514a904a0e14d1690ba6c132172b542_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar

IMPHASH 926764d6509bd768b05964d8c83a70b4
SHA256 b0197a98fbcd2ed7bb7612209740bb19d6d199ca1f795305d96dcd2dee977dd0
MD5 a514a904a0e14d1690ba6c132172b542
SHA1 488b7b741e2f600969c8a79ba8e9ba5d8194276d
SHA512 c5d91ea265b6414568f4e52cb329e99dc1660273b2731b235a4dacd53f166a7e1058dfa6473f582e81832b444ae80866517f22d4ca91882005b923c73ee3ac50
SSDEEP 98304:Zn/+2rD2XiuzWzNbhFVj3hOhY5gNppnqf3b2:Z/BoDzm33zOjp8
TLSH
T17D263304F6D496FAE1B68639C26A0501F336BD015B0DB7CF4264E1A82E377CA1973BE5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileType GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcmpW

Name

.text

Size

150KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

759KB

Virtual Size

760KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_a514a904a0e14d1690ba6c132172b542_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk_satacom_vidar

kernel32

generic