2026-11-03_700215562140e1a8248ab967523abad4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

General

Target
2026-11-03_700215562140e1a8248ab967523abad4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 354KB
Sample261104-vzk4astsax
SHA256 85081da0f66f49d53746f78a30e2abdbbaa4c4b8a7a9a3659786ee1216f3aa48
MD5 700215562140e1a8248ab967523abad4
SHA1 7d89c0e7ef8a671eac158afb6064750f1c748c18
SHA512 9222638d43cf7555faa53e387e78f0cd5ecddb3be522c181ec2ecc51e22a70093356fd2a4b60a47b125508157f246f165cf1e90228165cb6cd39e360a76f0b66
SSDEEP 6144:ZGTzepBjIBZx9eF5p5Sn8Y8oiDPYUN7qOR6NkV3OQa:cTyOWHSn8Y3iz5R6NkB
TLSH
T14574AE16F39605F4D4ABD134CA564682FBF67C6A03119AAF2BE442252F336F06E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_700215562140e1a8248ab967523abad4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-11-03_700215562140e1a8248ab967523abad4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 354KB

2026-11-03_700215562140e1a8248ab967523abad4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 8b010f2fcdb2adce46c3ea2dd91e5dbd
SHA256 85081da0f66f49d53746f78a30e2abdbbaa4c4b8a7a9a3659786ee1216f3aa48
MD5 700215562140e1a8248ab967523abad4
SHA1 7d89c0e7ef8a671eac158afb6064750f1c748c18
SHA512 9222638d43cf7555faa53e387e78f0cd5ecddb3be522c181ec2ecc51e22a70093356fd2a4b60a47b125508157f246f165cf1e90228165cb6cd39e360a76f0b66
SSDEEP 6144:ZGTzepBjIBZx9eF5p5Sn8Y8oiDPYUN7qOR6NkV3OQa:cTyOWHSn8Y3iz5R6NkB
TLSH
T14574AE16F39605F4D4ABD134CA564682FBF67C6A03119AAF2BE442252F336F06E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

171528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

imagehlp

CheckSumMappedFile

kernel32

WriteConsoleW GetLastError RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetEndOfFile RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ReadFile ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetFileType CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadConsoleW SetFilePointerEx GetFileSizeEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW CreateFileW HeapSize HeapReAlloc

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_700215562140e1a8248ab967523abad4_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

imagehlp

kernel32

generic