2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar
Size 681KB
Sample261108-3dadnsvtfs
SHA256 660dc5bbb89e25706a79aae40fb0b3b7cfca1ccf57fcef464c7ce821ca8c677d
MD5 9591855f7ea38c0f8a3a4221101db80f
SHA1 11cb36779b2079092a608a671fa69370d9bafd2b
SHA512 0476629dfc92f88f650988761e3407acf743a36a001120c9451d72595762235cdeda035d774dfc4df2b9c37c74216efb7ff6cc760d745071ad646a400dd03746
SSDEEP 12288:Q7BYI1c9hZOQ1joxPSb3Iu9in2YBd9RVDXtSAyY:yb1cQQCSb4u9inBBdjVBSAl
TLSH
T1D8E46B16A6E501FBD0BAE434C9970A27FE3138640324A5EB53D06A972F677E0773E391
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

.exe 681KB

2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 38c74e15cf32b349d78721584ead3618
SHA256 660dc5bbb89e25706a79aae40fb0b3b7cfca1ccf57fcef464c7ce821ca8c677d
MD5 9591855f7ea38c0f8a3a4221101db80f
SHA1 11cb36779b2079092a608a671fa69370d9bafd2b
SHA512 0476629dfc92f88f650988761e3407acf743a36a001120c9451d72595762235cdeda035d774dfc4df2b9c37c74216efb7ff6cc760d745071ad646a400dd03746
SSDEEP 12288:Q7BYI1c9hZOQ1joxPSb3Iu9in2YBd9RVDXtSAyY:yb1cQQCSb4u9inBBdjVBSAl
TLSH
T1D8E46B16A6E501FBD0BAE434C9970A27FE3138640324A5EB53D06A972F677E0773E391
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31220

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\admin\Desktop\all src latest 04.11.26\all src latest\fortnite injector\fortnite injector\x64\Release\injector.pdb

kernel32

GetLastError DeleteFileA DeleteFileW CloseHandle MoveFileExW SetFileAttributesW CreateProcessA RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetFileAttributesW CreateFileW WaitForSingleObject GetTempPathW RemoveDirectoryA WriteFile GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte RtlCaptureContext

user32

MessageBoxA MessageBoxW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

SHCreateDirectoryExW

msvcp140

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z

wininet

InternetCloseHandle InternetReadFile InternetOpenW InternetOpenUrlA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate __std_exception_copy _CxxThrowException memmove memcpy __current_exception __C_specific_handler memset __current_exception_context __std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

__p___argv __p___argc _exit _cexit _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _c_exit _initterm_e _seh_filter_exe _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit exit _set_app_type terminate _invoke_watson system abort

api-ms-win-crt-stdio-l1-1-0

fwrite fgetc __p__commode fclose fflush fgetpos setvbuf fputc fsetpos fread _fseeki64 _get_stream_buffer_pointers _set_fmode ungetc

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-08_9591855f7ea38c0f8a3a4221101db80f_cobalt-strike_icedid_luca-stealer_njrat_stealc_vidar

kernel32

user32

advapi32

shell32

msvcp140

wininet

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic