2026-11-02_c998852b7fbbca9727c83a46335f804d_cobalt-strike_icedid_luca-stealer_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_c998852b7fbbca9727c83a46335f804d_cobalt-strike_icedid_luca-stealer_njrat_vidar
Size 2.5MB
Sample261102-2rbcfsdw7w
SHA256 494d6ba64fabb05748016b33cff9b99ea89a95572bb0aad6becb5149c7a682b7
MD5 c998852b7fbbca9727c83a46335f804d
SHA1 909df8ebd55ca7515de3639d033204706de13e98
SHA512 6f0a7881d0560da13580282d5f7b4344f2f2f6f146d7e0a2fe804299df47aeb57879430977d710546eb2af9db3644f2c2974e78504b72b3dedb5d0763c2df0a2
SSDEEP 49152:IQtpwWtZ5gT8/k0tGcXzRpP+LwLCYeDhhqEAbfBAmeCGQLV9YW:+0Ac1PEDTWAfSVqW
TLSH
T158C58D0B62AD01F9D0B7D17CC9075907EAB2381A47715BDF0291866B2F6BAF18E7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_c998852b7fbbca9727c83a46335f804d_cobalt-strike_icedid_luca-stealer_njrat_vidar

File Explorer

2026-11-02_c998852b7fbbca9727c83a46335f804d_cobalt-strike_icedid_luca-stealer_njrat_vidar

.exe 2.5MB

2026-11-02_c998852b7fbbca9727c83a46335f804d_cobalt-strike_icedid_luca-stealer_njrat_vidar

IMPHASH 93afe7c2b3dbbf10e6fff07b0fb8673b
SHA256 494d6ba64fabb05748016b33cff9b99ea89a95572bb0aad6becb5149c7a682b7
MD5 c998852b7fbbca9727c83a46335f804d
SHA1 909df8ebd55ca7515de3639d033204706de13e98
SHA512 6f0a7881d0560da13580282d5f7b4344f2f2f6f146d7e0a2fe804299df47aeb57879430977d710546eb2af9db3644f2c2974e78504b72b3dedb5d0763c2df0a2
SSDEEP 49152:IQtpwWtZ5gT8/k0tGcXzRpP+LwLCYeDhhqEAbfBAmeCGQLV9YW:+0Ac1PEDTWAfSVqW
TLSH
T158C58D0B62AD01F9D0B7D17CC9075907EAB2381A47715BDF0291866B2F6BAF18E7E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1336592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qba1\workspace\6834\SSE_Storage_Middleware\RstMwService\output\Release\x64\RstMwService.pdb

kernel32

DeleteCriticalSection FormatMessageW InitializeCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc CreateFileA HeapAlloc GetTickCount CreateMutexA EnterCriticalSection HeapDestroy ResetEvent CreateEventA GetSystemTimeAsFileTime LocalAlloc DecodePointer ReadFile Sleep lstrlenA DeleteFileA InitializeCriticalSectionAndSpinCount VerSetConditionMask VerifyVersionInfoA GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW LocalFree SetEnvironmentVariableW GetDiskFreeSpaceExA CreateFileW SetLastError DeviceIoControl ReleaseSRWLockExclusive CompareStringEx LCMapStringEx InitOnceExecuteOnce ReleaseMutex AcquireSRWLockExclusive WakeAllConditionVariable OpenProcess GetPackageId GetPackagePath FormatMessageA K32GetModuleBaseNameW K32GetModuleFileNameExW SleepConditionVariableCS WakeConditionVariable InitializeConditionVariable TryEnterCriticalSection TryAcquireSRWLockExclusive InitializeSRWLock GetExitCodeThread SetWaitableTimer CreateWaitableTimerA WaitForSingleObjectEx GetSystemTimePreciseAsFileTime QueryPerformanceFrequency CreateMutexW WaitForMultipleObjects GetFirmwareEnvironmentVariableW SetFirmwareEnvironmentVariableW OpenEventA OpenMutexA GetCurrentProcess GetCurrentThread SleepConditionVariableSRW WaitForSingleObject CloseHandle GetLastError CreateEventW GetCurrentProcessId EncodePointer LeaveCriticalSection SetEvent WTSGetActiveConsoleSessionId QueryPerformanceCounter InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx WriteConsoleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW GetSystemInfo VirtualAlloc VirtualProtect VirtualQuery GetCurrentThreadId ExitProcess GetModuleHandleW GetProcAddress FlsAlloc FlsGetValue FlsSetValue FlsFree LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW RaiseException GetStdHandle GetFileType GetStartupInfoW WideCharToMultiByte MultiByteToWideChar GetCPInfo GetStringTypeW IsValidCodePage GetACP GetOEMCP GetFileSizeEx SetFilePointerEx SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode GetModuleFileNameW InitializeSListHead

advapi32

RevertToSelf InitiateSystemShutdownA RegSetKeyValueW RegCreateKeyExW StartServiceCtrlDispatcherW UnregisterTraceGuids RegisterTraceGuidsW LookupPrivilegeValueA GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle RegisterServiceCtrlHandlerW TraceMessage SetServiceStatus AdjustTokenPrivileges OpenProcessToken RegQueryValueExW RegOpenKeyExW ReportEventW RegisterEventSourceW AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl RegSetValueExA RegQueryValueExA RegOpenKeyExA RegDeleteValueA RegCreateKeyExA RegCloseKey RegDeleteTreeA SetEntriesInAclW DeregisterEventSource ImpersonateLoggedOnUser ChangeServiceConfigA CloseServiceHandle ControlService DeleteService EnumDependentServicesA OpenSCManagerA OpenThreadToken CopySid EqualSid GetLengthSid GetSidLengthRequired GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation InitializeSid IsValidSid QueryServiceStatusEx OpenServiceA

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

rpcrt4

NdrServerCallAll RpcBindingVectorFree UuidToStringA RpcStringFreeA RpcServerInqBindings RpcServerListen RpcServerRegisterIf3 RpcServerUnregisterIf RpcServerUseProtseqEpW RpcMgmtStopServerListening I_RpcBindingInqLocalClientPID I_RpcGetCurrentCallHandle RpcEpRegisterW RpcEpUnregister RpcRevertToSelf RpcImpersonateClient NdrServerCall2 RpcRevertToSelfEx

userenv

UnloadUserProfile

setupapi

CM_Get_Device_Interface_ListW CM_Get_Device_Interface_List_SizeW CM_Get_Device_ID_List_SizeW CM_Locate_DevNodeW CM_Get_Device_ID_ListW

api-ms-win-devices-swdevice-l1-1-0

SwDeviceCreate SwDeviceClose

api-ms-win-devices-swdevice-l1-1-1

SwDeviceSetLifetime

ole32

CoInitializeEx CoUninitialize CoMarshalInterThreadInterfaceInStream CoGetInterfaceAndReleaseStream CoCreateInstance CoCreateGuid CoTaskMemFree StringFromGUID2 CoReleaseMarshalData CoSetProxyBlanket

api-ms-win-devices-config-l1-1-1

CM_Get_DevNode_PropertyW CM_Get_Device_Interface_PropertyW

user32

GetSystemMetrics

api-ms-win-core-path-l1-1-0

PathCchAppend

wintrust

WinVerifyTrust

oleaut32

SafeArrayCreate VariantClear VariantInit SysFreeString SafeArrayLock SysAllocString SafeArrayUnlock

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

428KB

Virtual Size

427KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

50KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_c998852b7fbbca9727c83a46335f804d_cobalt-strike_icedid_luca-stealer_njrat_vidar

kernel32

advapi32

wtsapi32

api-ms-win-security-base-l1-2-2

rpcrt4

userenv

setupapi

api-ms-win-devices-swdevice-l1-1-0

api-ms-win-devices-swdevice-l1-1-1

ole32

api-ms-win-devices-config-l1-1-1

user32

api-ms-win-core-path-l1-1-0

wintrust

oleaut32

generic