2026-09-17_8d8ac85f9ed998164e52ac9842202dbf_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
Multiple malware families, encoded payloads
Detects an XORed URL in an executableEmbedded PE binary at file offset 0x5b610 (~895984 bytes)
SHA-256cee0642708a7be9e5be349c64058869a440710fe49527dd393a9c2bcb99c9f5d
MaleculeMdTh
Evidence
⋯3 more rows
0x5b600ffffffff010000000a00000000000000................
0x5b6104d5a90000300000004000000ffff0000MZ..............
0x5b620b8000000000000004000000000000000........@.......
0x5b63000000000000000000000000000000000................
⋯7 more rows
⋯3 more rows
0x621263024302206082b0601050507300186160$0"..+.....0...
0x62136687474703a2f2f6f6373702e74686177http://ocsp.thaw
0x6214674652e636f6d30120603551d130101ffte.com0...U.....
⋯7 more rows
⋯3 more rows
0x679007c7b721f15d9d9d9d9d9d9d9d9d9d9d9|{r.............
0x679105b717135427c7b717a62663551677c63[qq5B|{qzbf5Qg|c
0x6792070675471715170637c76702f35717a7bpgTqqQpc|vp/5qz{
0x67930701f15d9d9d9d9d9d9d9d9d9d9d9d9d9p...............
0x679405b717135427c7b717a62663551677c63[qq5B|{qzbf5Qg|c
⋯4 more rows
0x6799076157015661549155b15711571151515v.p.f.I.[.q.q...
0x679a05b717135427c7b717a62663551677c63[qq5B|{qzbf5Qg|c
0x679b070675c7a5667707461705170637c7670pg\zVgptapQpc|vp
0x679c03573747c7970713b35354661746160665st|ypq;55Fata`f
0x679d0352835256d30256d1f15d9d9d9d9d9d95(5%m0%m........
0x679e049155115701563157c15761570154915I.Q.p.c.|.v.p.I.
0x679f05b15711571151515d9d9d9d9d9d9d9d9[.q.q...........
0x67a005b717135427c7b717a62663551677c63[qq5B|{qzbf5Qg|c
0x67a1070675471715170637c76702f35707b61pgTqqQpc|vp/5p{a
0x67a20706770711f15d9d9d9d9d9d9d9d9d9d9pgpq............
0x67a305b747935427c7b717a62663551677c63[ty5B|{qzbf5Qg|c
0x67a4070675667707461702f35597074637c7bpgVgptap/5Yptc|{
0x67a50721f15d9d9d9d9d9d9d9d9d9d9d9d9d9r...............
0x67a605b747935427c7b717a62663551677c63[ty5B|{qzbf5Qg|c
0x67a7070675667707461702f3546617467617cpgVgptap/5Fatga|
0x67a807b721f15d9d9d9d9d9d9d9d9d9d9d9d9{r..............
0x67a905b747935427c7b717a62663551677c63[ty5B|{qzbf5Qg|c
0x67aa0706756797a66702f35597074637c7b72pgVyzfp/5Yptc|{r
0x67ab01f15d9d9d9d9d9d9d9d9d9d9d9d9d9d9................
0x67ac05b747935427c7b717a62663551677c63[ty5B|{qzbf5Qg|c
0x67ad0706756797a66702f3546617467617c7bpgVyzfp/5Fatga|{
0x67ae0721f15d9d9d9d9d9d9d9d9d9d9d9d9d9r...............
0x67af05b74795170637c7670567a7b61677a79[tyQpc|vpVz{agzy
0x67b002f355c7b656061576073737067356274/5\{e`aW`sspg5bt
0x67b1066355b4059591f15d9d9d9d9d9d9d9d9f5[@YY..........
0x67b205b747935427c7b717a62663551677c63[ty5B|{qzbf5Qg|c
0x67b3070675170637c7670567a7b61677a792fpgQpc|vpVz{agzy/
0x67b40355c7b6374797c71355c5a56415935765\{cty|q5\ZVAY5v
0x67b507a717035256d30256d1f15d9d9d9d9d9zqp5%m0%m.......
0x67b605b54594a505b545759504a5150574052[TYJP[TWYPJQPW@R
0x67b704a45475c5b414a53405b565c512f3553JEG\[AJS@[V\Q/5S
0x67b80607b76617c7a7b51746174357c66355b`{va|z{Qtat5|f5[
0x67b904059591f15d9d9d9d9d9d9d9d9d9d9d9@YY.............
⋯3 more rows
⋯3 more rows
0x69e66151567145c7a5367707058717915c717..g.\zSgppXqy...
0x69e765878587465597a767e70714574727066XxXteYzv~pqEtrpf
0x69e86466570767c736c5674767d701515a717Fepv|slVtv}p....
0x69e96587857607c7971587179537a675b7a7bXxW`|yqXqySzg[z{
⋯7 more rows