2026-11-01_f5a63d4f8953d25a8eb73d1bce2cc41d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

General

Target
2026-11-01_f5a63d4f8953d25a8eb73d1bce2cc41d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 4.4MB
Sample261102-demb7aev8v
SHA256 da4710ec5938b3f7f49cb6e658e22099f5424315233e8ae88d43f682a00cecd9
MD5 f5a63d4f8953d25a8eb73d1bce2cc41d
SHA1 f5feb8bb2c0d8a9c03f12af84c408dcfbeaed1c4
SHA512 943f93117269cd6f6435aaacbaf58423f9716687351060e2e34d791a09991809c0c13fe359a58df624f827828cda69387d55e0b5ca87bf1839ff21188aaecd67
SSDEEP 49152:60MqwXOOm+Q3diP30B/c5KgGRejPDmg27RnWGj:MORifKgsaD527BWG
TLSH
T1D0262B12F7660DE6C99380B0CD776B21CB96BC780BF007B76B324ACE657A6D0352A745
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_f5a63d4f8953d25a8eb73d1bce2cc41d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-11-01_f5a63d4f8953d25a8eb73d1bce2cc41d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 4.4MB

2026-11-01_f5a63d4f8953d25a8eb73d1bce2cc41d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH d3c8bfce75e6e6365f09a109f4ea2d24
SHA256 da4710ec5938b3f7f49cb6e658e22099f5424315233e8ae88d43f682a00cecd9
MD5 f5a63d4f8953d25a8eb73d1bce2cc41d
SHA1 f5feb8bb2c0d8a9c03f12af84c408dcfbeaed1c4
SHA512 943f93117269cd6f6435aaacbaf58423f9716687351060e2e34d791a09991809c0c13fe359a58df624f827828cda69387d55e0b5ca87bf1839ff21188aaecd67
SSDEEP 49152:60MqwXOOm+Q3diP30B/c5KgGRejPDmg27RnWGj:MORifKgsaD527BWG
TLSH
T1D0262B12F7660DE6C99380B0CD776B21CB96BC780BF007B76B324ACE657A6D0352A745
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

311616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\rel\gpu_drv\r615\r616_41\drivers\nvcamera\redist\_out\wddm2_amd64_release\NvImageConvert64.pdb

shlwapi

PathFindExtensionA

windowscodecs

WICConvertBitmapSource

kernel32

LoadLibraryExW IsProcessorFeaturePresent CreateFileA CreateFileW GetFileSize CloseHandle CreateFileMappingW MapViewOfFile UnmapViewOfFile DecodePointer GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection FormatMessageA WideCharToMultiByte WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx LocalFree GetLocaleInfoEx EncodePointer LCMapStringEx QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW OutputDebugStringW RaiseException RtlPcToFileHeader RtlUnwindEx SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary RtlUnwind CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc HeapSize GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap WriteConsoleW SetEndOfFile DeleteFileW LocalAlloc lstrlenA ReplaceFileW InitializeCriticalSection DebugBreak ReleaseSemaphore WaitForSingleObject CreateSemaphoreA

ole32

CoInitializeEx CoCreateInstance CoUninitialize

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

286B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_f5a63d4f8953d25a8eb73d1bce2cc41d_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

shlwapi

windowscodecs

kernel32

ole32

generic