2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

General

Target
2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.9MB
Sample261102-nvkteaeh49
SHA256 862dc6e96c9cb09320855d60b895792a5ec97dad344f55f95632807b06b5704d
MD5 af291272de2b35549e588b2db581903d
SHA1 878f6676469b0062ee9f8bc115626955653f5d30
SHA512 aceef9185f78e650ce8c29873c489d6b5b8c7c19005eb8c5130be5e0bba62e2f8f52751eed46184c1b1e280029d250232ef43d268b1800475e4f6b832e3b1a71
SSDEEP 24576:CvH41soMoAXDNiaGGbCeyNtDPAZRUkYagJstji01sk0wuqsObMnQ/tbw/2Mkjy6+:CXzNiaBCe8tDPAZBe7lqs1Q/lFTjN4
TLSH
T18295BF1BA29781F9CDA6D178C852CD42E632780543518BDF22A0935A7EF76F04E3E778
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.9MB

2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH a810451affc37e08f091ab4ce1fd3eab
SHA256 862dc6e96c9cb09320855d60b895792a5ec97dad344f55f95632807b06b5704d
MD5 af291272de2b35549e588b2db581903d
SHA1 878f6676469b0062ee9f8bc115626955653f5d30
SHA512 aceef9185f78e650ce8c29873c489d6b5b8c7c19005eb8c5130be5e0bba62e2f8f52751eed46184c1b1e280029d250232ef43d268b1800475e4f6b832e3b1a71
SSDEEP 24576:CvH41soMoAXDNiaGGbCeyNtDPAZRUkYagJstji01sk0wuqsObMnQ/tbw/2Mkjy6+:CXzNiaBCe8tDPAZBe7lqs1Q/lFTjN4
TLSH
T18295BF1BA29781F9CDA6D178C852CD42E632780543518BDF22A0935A7EF76F04E3E778
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

339932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\appveyor\projects\hidhide\bin\Release\x64\HidHideWatchdog.pdb

setupapi

SetupDiOpenClassRegKey

kernel32

DeleteCriticalSection WaitForSingleObject CreateEventW RaiseException SetThreadPriority GetExitCodeThread TlsAlloc TlsGetValue TlsSetValue TlsFree SetConsoleCtrlHandler GetModuleFileNameW FreeLibrary GetProcAddress LoadLibraryW WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WaitForSingleObjectEx QueryPerformanceCounter QueryPerformanceFrequency WideCharToMultiByte MultiByteToWideChar GetTempPathW InitializeCriticalSectionEx GetModuleHandleW EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter ResetEvent InitializeCriticalSectionAndSpinCount VirtualFree IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList LoadLibraryExW SetStdHandle GetFileType CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetFileSizeEx SetFilePointerEx ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize CreateFileW SetEvent LeaveCriticalSection EnterCriticalSection WriteConsoleW GetSystemTimeAsFileTime CreateMutexA SetLastError FormatMessageA GetCurrentProcessId LocalFree CloseHandle GetLastError GetConsoleMode GetCurrentThreadId GetDynamicTimeZoneInformation WriteFile WriteConsoleA GetStdHandle GetCurrentProcess TerminateProcess Sleep SetFilePointer GetCurrentDirectoryW GetLongPathNameW GetSystemDirectoryW DeleteFileW GetFileAttributesW GetFileAttributesExW RemoveDirectoryW MoveFileExW GetEnvironmentVariableW GetSystemInfo GetVersionExW GetComputerNameW FormatMessageW FindFirstFileW ReleaseMutex RtlUnwind SetConsoleTextAttribute GetConsoleScreenBufferInfo SetUnhandledExceptionFilter IsProcessorFeaturePresent

advapi32

ReportEventW RegisterEventSourceW RegOpenKeyExW RegCreateKeyExW DeleteService CreateServiceW GetTokenInformation RegisterEventSourceA QueryServiceStatusEx GetLengthSid OpenServiceW OpenProcessToken ReportEventA IsValidSid CopySid OpenSCManagerW CloseServiceHandle DeregisterEventSource RegQueryValueExW CheckTokenMembership FreeSid RegSetValueExW AllocateAndInitializeSid RegCloseKey ChangeServiceConfigW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW

iphlpapi

GetAdaptersAddresses

Name

.text

Size

937KB

Virtual Size

936KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

382KB

Virtual Size

381KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_af291272de2b35549e588b2db581903d_akira_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

setupapi

kernel32

advapi32

iphlpapi

generic