2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 1.6MB
Sample261104-try5hsbv4v
SHA256 f4b4a81126e184804ef9c5e9857e47848d205e2b934633e8ab62911c53ad69b9
MD5 7a555b5ce70f99ab822c36e5ff76cd5c
SHA1 9c486634446f5e1994dbecfae5a989028dd46ae4
SHA512 f610d0886da093f6673f4f6c5628f1e38735bd4620f27929115e2749d9534bf0b3764050ccb3ee8c8ba4999d25f4f01c79810d7eef8a0147580dd5d56d920e3c
SSDEEP 24576:3EIU58bWMKEz5CYtL0jrsS85iA7qPsWpj0K4VsuFAAk8vH8VQ/Omtd7mPuI7cpcg:3xQPXECR4p7012GuSzfmWPuIw
TLSH
T138851259E7A804FCE4AB9138C5554A42FB76BC5A077097DF23A047662F332E05D3EB90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 1.6MB

2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 534a1143bd7c6d9f0c98f18367c5e20f
SHA256 f4b4a81126e184804ef9c5e9857e47848d205e2b934633e8ab62911c53ad69b9
MD5 7a555b5ce70f99ab822c36e5ff76cd5c
SHA1 9c486634446f5e1994dbecfae5a989028dd46ae4
SHA512 f610d0886da093f6673f4f6c5628f1e38735bd4620f27929115e2749d9534bf0b3764050ccb3ee8c8ba4999d25f4f01c79810d7eef8a0147580dd5d56d920e3c
SSDEEP 24576:3EIU58bWMKEz5CYtL0jrsS85iA7qPsWpj0K4VsuFAAk8vH8VQ/Omtd7mPuI7cpcg:3xQPXECR4p7012GuSzfmWPuIw
TLSH
T138851259E7A804FCE4AB9138C5554A42FB76BC5A077097DF23A047662F332E05D3EB90
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

98872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\pc\other_tools\driverinstaller\InfInstaller\x64\Release\InfInstallerx64.pdb

kernel32

LocalAlloc GetModuleHandleA Sleep CopyFileA GetLastError GetFileAttributesA DeleteFileA WaitForSingleObject GetSystemInfo GetProcAddress LocalFree RemoveDirectoryA CreateProcessA CreateDirectoryA GetPrivateProfileStringA SetEndOfFile PeekNamedPipe CreatePipe CloseHandle ReadFile WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW GetFileAttributesExW WideCharToMultiByte MultiByteToWideChar LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW FindClose FindFirstFileExW FindNextFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapReAlloc RtlUnwind

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

shlwapi

PathFileExistsA

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo CM_Locate_DevNodeA SetupDiBuildDriverInfoList SetupDiGetDriverInfoDetailA SetupUninstallOEMInfA SetupDiEnumDriverInfoA CM_Reenumerate_DevNode SetupDiGetClassDevsA SetupDiGetClassDevsExA

newdev

DiUninstallDevice

Name

.text

Size

247KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

936B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_7a555b5ce70f99ab822c36e5ff76cd5c_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

kernel32

advapi32

shlwapi

setupapi

newdev

generic