2026-07-16_c0a234afffe7f527f44c2dfe7a4f1b08_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-16_c0a234afffe7f527f44c2dfe7a4f1b08_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_vidar
Size 208KB
Sample260716-ndfhcsfs7x
SHA256 3fc551eebb841072c124b94469e2120063a7aafe77d654edb2794232bedf523c
MD5 c0a234afffe7f527f44c2dfe7a4f1b08
SHA1 fd20c26e3814d83ae3755caed757d9cb94bd1005
SHA512 3d1cf7055c992281faa54951bce716b9c91e6b8dd4a680238ef550f82c72582103584f49466d5fb559dd446b6c89adb9b6581093bfa152438c76ce9b80efea37
SSDEEP 3072:bFEhu/eEWlAF5x5DApYB0PrckQyySl53rfxA5JdeuZy7LdltXPxtjOE:aQ2zlM5xupYaPrBySu47Ldlh
TLSH
T1C7246C51B3E805E9F5F782F4C9B05646EB7378910770875F03A48269AF33691AE39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-16_c0a234afffe7f527f44c2dfe7a4f1b08_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_vidar

.exe 208KB

2026-07-16_c0a234afffe7f527f44c2dfe7a4f1b08_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH cbf7526d7092c7a4be7d9ff2d363c48c
SHA256 3fc551eebb841072c124b94469e2120063a7aafe77d654edb2794232bedf523c
MD5 c0a234afffe7f527f44c2dfe7a4f1b08
SHA1 fd20c26e3814d83ae3755caed757d9cb94bd1005
SHA512 3d1cf7055c992281faa54951bce716b9c91e6b8dd4a680238ef550f82c72582103584f49466d5fb559dd446b6c89adb9b6581093bfa152438c76ce9b80efea37
SSDEEP 3072:bFEhu/eEWlAF5x5DApYB0PrckQyySl53rfxA5JdeuZy7LdltXPxtjOE:aQ2zlM5xupYaPrBySu47Ldlh
TLSH
T1C7246C51B3E805E9F5F782F4C9B05646EB7378910770875F03A48269AF33691AE39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

dd:76:22:3c:59:33:47:6e:68:a7:0d:80:86:d0:41:b9:7e:2d:61:91:82:d0:1e:9b:97:55:1b:62:83:16:62:44

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 27, 2023

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

dd:76:22:3c:59:33:47:6e:68:a7:0d:80:86:d0:41:b9:7e:2d:61:91:82:d0:1e:9b:97:55:1b:62:83:16:62:44

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ELAN MICROELECTRONICS CORPORATION,O=ELAN MICROELECTRONICS CORPORATION,L=Hsinchu County,C=TW

Chains

Mar 24, 2023

CN=ELAN MICROELECTRONICS CORPORATION,O=ELAN MICROELECTRONICS CORPORATION,L=Hsinchu County,C=TW

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:1c:b2:8a:00:00:00:00:00:26

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=ELAN MICROELECTRONICS CORPORATION,O=ELAN MICROELECTRONICS CORPORATION,L=Hsinchu County,C=TW

Serial Number

0b:5e:96:40:15:99:37:2e:99:c5:3b:59:13:7e:2a:78

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 17, 2020 - Jan 30, 2024

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:f5:e8:77:3b:20:6b:1c:cd:61:00:00:00:00:00:f5

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 12, 2023 - Dec 15, 2023

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:FC41-4BD4-D220,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:b9:f6:00:0d:65:54:4f:bc:03:00:01:00:00:01:b9

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 20, 2022 - Dec 14, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

21388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\F867_Solution\WBF_Driver\ELANMOCService\x64\Release\ELAN_MOC_Service.pdb

cfgmgr32

CM_Get_DevNode_Status

advapi32

GetTraceLoggerHandle CreateServiceW ReportEventW RegisterEventSourceW TraceMessage QueryServiceStatus CloseServiceHandle OpenSCManagerW DeregisterEventSource UnregisterTraceGuids RegisterTraceGuidsW GetTraceEnableLevel GetTraceEnableFlags DeleteService ControlService RegQueryValueExW OpenServiceW RegisterServiceCtrlHandlerExW RegCloseKey StartServiceCtrlDispatcherW RegOpenKeyExW SetServiceStatus

kernel32

Sleep CreateFileW SetEvent TerminateThread HeapReAlloc WaitForSingleObject CreateThread ResetEvent HeapSize WaitForMultipleObjects GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetModuleFileNameW WriteConsoleW GetLastError GetLocalTime CloseHandle OutputDebugStringW CreateEventW SetFilePointerEx GetFileSizeEx GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCPInfo GetOEMCP EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP

setupapi

SetupDiCallClassInstaller SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiSetClassInstallParamsW SetupDiDestroyDeviceInfoList

user32

wsprintfW UnregisterPowerSettingNotification RegisterPowerSettingNotification

Name

.text

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-16_c0a234afffe7f527f44c2dfe7a4f1b08_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_vidar

cfgmgr32

advapi32

kernel32

setupapi

user32

generic