2026-11-12_19ebd8ee4bda33d8b8933882df31485b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-12_19ebd8ee4bda33d8b8933882df31485b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 332KB
Sample261113-jc5nmsg19t
SHA256 33b413e4f408931bfe3317ef480e5adadf15fedebd856724df01d3fb3bc7a0f4
MD5 19ebd8ee4bda33d8b8933882df31485b
SHA1 c01e61c1fbcfc5a113da28b53d3f381bac0aeec7
SHA512 013110424ff586b2c70b381fb2c0f06cde71580e07690406711c47c1a2d0d0b71466000f85540c1728ba32a3e0d525bd3530d5d5779b4856e7e82fa3b8df5edb
SSDEEP 6144:EHuJmOx+P/gkOVXDTISvmokdeRHILr1Y/hiUVNhR8cq:Kv9OVXDTfJ0eRSA
TLSH
T1EE748E15F6A43479E5A78238C9C27906D6F27C460F6197CF03E01AB67F2B6D09A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_19ebd8ee4bda33d8b8933882df31485b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-11-12_19ebd8ee4bda33d8b8933882df31485b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 332KB

2026-11-12_19ebd8ee4bda33d8b8933882df31485b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 1e85809445d9dc3e6c1dbc26116b1112
SHA256 33b413e4f408931bfe3317ef480e5adadf15fedebd856724df01d3fb3bc7a0f4
MD5 19ebd8ee4bda33d8b8933882df31485b
SHA1 c01e61c1fbcfc5a113da28b53d3f381bac0aeec7
SHA512 013110424ff586b2c70b381fb2c0f06cde71580e07690406711c47c1a2d0d0b71466000f85540c1728ba32a3e0d525bd3530d5d5779b4856e7e82fa3b8df5edb
SSDEEP 6144:EHuJmOx+P/gkOVXDTISvmokdeRHILr1Y/hiUVNhR8cq:Kv9OVXDTfJ0eRSA
TLSH
T1EE748E15F6A43479E5A78238C9C27906D6F27C460F6197CF03E01AB67F2B6D09A3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

75064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Unquivocate\Desktop\Visual Studio\Loader\x64\Release\Loader.pdb

kernel32

Process32NextW Process32FirstW CloseHandle GetWindowsDirectoryW GetProcAddress ExitProcess ReadProcessMemory GetCurrentProcessId CreateProcessW GetModuleHandleW WideCharToMultiByte GetTempFileNameW CreateProcessA GetDiskFreeSpaceExA GetExitCodeProcess WriteProcessMemory Wow64SetThreadContext Wow64GetThreadContext GetThreadContext SetThreadContext WriteFile GetLastError CreateFileW SetEndOfFile CreateToolhelp32Snapshot OpenProcess GetModuleHandleA ResumeThread ReleaseMutex WaitForSingleObject GetTempPathW WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP CreateFileTransactedW GetModuleFileNameW IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId MultiByteToWideChar GetStringTypeW InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetStdHandle HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType RtlUnwind

advapi32

RegCreateKeyExW CheckTokenMembership RegCloseKey AllocateAndInitializeSid RegOpenKeyExW RegSetValueExW FreeSid

shell32

SHGetFolderPathW

ole32

CoGetObject CoUninitialize CoInitializeEx

wininet

HttpQueryInfoA InternetOpenUrlA InternetOpenA InternetCloseHandle InternetReadFile

crypt32

CryptStringToBinaryA

ntdll

NtMapViewOfSection NtCreateSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

ktmw32

CreateTransaction RollbackTransaction

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_19ebd8ee4bda33d8b8933882df31485b_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

advapi32

shell32

ole32

wininet

crypt32

ntdll

ktmw32

generic