2026-11-11_176bcd17f27a8c85d1a4b495eb893e8f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-11_176bcd17f27a8c85d1a4b495eb893e8f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 956KB
Sample261113-vaxe2ax19l
SHA256 7495cedd39431788294388f5dd30090c2f2fae1b3f93ecdef0d3896b29bc0738
MD5 176bcd17f27a8c85d1a4b495eb893e8f
SHA1 9fa8b9e873c5af42c53dccf9f2452937b47c2f8a
SHA512 bb59c61bda8174212378912a6c9331bbec7ec6d4381d9019dc8bdd4388fc381ec92c324fbfc8b1e161d197dedc8afbae2bd7ee822568ee05abee780425d54220
SSDEEP 24576:55FRZp1b1TOE5lObAfYLH8AcevDN0FImbwQuq3Wia7gDd:lRbqrAQgAT76sQuEd
TLSH
T1EF25E006F79904F9E4B7D13889728502E6B27C5A0370DBEF13A846572F376D09E7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_176bcd17f27a8c85d1a4b495eb893e8f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-11-11_176bcd17f27a8c85d1a4b495eb893e8f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 956KB

2026-11-11_176bcd17f27a8c85d1a4b495eb893e8f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 04b4a6b96b9846ea6f9fbad375d8cbdd
SHA256 7495cedd39431788294388f5dd30090c2f2fae1b3f93ecdef0d3896b29bc0738
MD5 176bcd17f27a8c85d1a4b495eb893e8f
SHA1 9fa8b9e873c5af42c53dccf9f2452937b47c2f8a
SHA512 bb59c61bda8174212378912a6c9331bbec7ec6d4381d9019dc8bdd4388fc381ec92c324fbfc8b1e161d197dedc8afbae2bd7ee822568ee05abee780425d54220
SSDEEP 24576:55FRZp1b1TOE5lObAfYLH8AcevDN0FImbwQuq3Wia7gDd:lRbqrAQgAT76sQuEd
TLSH
T1EF25E006F79904F9E4B7D13889728502E6B27C5A0370DBEF13A846572F376D09E7AB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

109712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\home\jenkins\agent\ws\Src\bin\x64\Release Static\crashlog_extractor.pdb

setupapi

SetupScanFileQueueW SetupOpenFileQueue CM_Get_DevNode_Status_Ex SetupDiCreateDeviceInfoW SetupDiGetDeviceInfoListDetailW SetupDiOpenDevRegKey SetupDiClassGuidsFromNameExW SetupDiSetDeviceRegistryPropertyW SetupDiDestroyDriverInfoList SetupDiOpenDeviceInfoW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiCreateDeviceInfoList SetupDiGetINFClassW SetupDiSetDeviceInstallParamsW SetupDiCreateDeviceInfoListExW SetupDiCallClassInstaller SetupDiBuildDriverInfoList SetupDiDestroyDeviceInfoList SetupDiSetClassInstallParamsW SetupDiGetDriverInfoDetailW SetupDiSetSelectedDriverW SetupDiEnumDriverInfoW SetupDiGetClassDevsExW SetupDiGetDeviceInstallParamsW SetupCloseFileQueue CM_Get_Device_ID_ExW

advapi32

EventRegister RegCloseKey EventUnregister RegQueryValueExW EventWriteString EventProviderEnabled

kernel32

HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleOutputCP Sleep FlushFileBuffers GetFileSizeEx GetLastError GetFileType LCMapStringW OutputDebugStringW CompareStringW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetFileAttributesW GetOEMCP GetACP IsValidCodePage HeapFree HeapAlloc GetEnvironmentStringsW GetCurrentProcess GetProcAddress GetModuleHandleW ReadFile GetCommandLineW GetCommandLineA CloseHandle GetProcessHeap VerSetConditionMask VerifyVersionInfoW CreateFileW LocalAlloc FormatMessageW LocalFree FreeEnvironmentStringsW SetEnvironmentVariableW lstrcmpA GetFullPathNameW SetStdHandle HeapSize WriteFile GetStdHandle WriteConsoleW GetModuleFileNameW GetModuleHandleExW ExitProcess WideCharToMultiByte LoadLibraryExW FreeLibrary TlsFree FormatMessageA FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW SetEndOfFile SetFileInformationByHandle SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx MultiByteToWideChar RtlUnwind GetStringTypeW QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError TlsAlloc TlsGetValue TlsSetValue

user32

CharNextW

crypt32

CryptDecodeObject CryptQueryObject CryptMsgGetParam CryptMsgClose CertCloseStore

wintrust

WinVerifyTrust

newdev

UpdateDriverForPlugAndPlayDevicesW

Name

.text

Size

261KB

Virtual Size

261KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_176bcd17f27a8c85d1a4b495eb893e8f_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar

setupapi

advapi32

kernel32

user32

crypt32

wintrust

newdev

generic