2026-07-31_b76ef53ba08bfceaddf79bb2811cd9aa_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

General

Target
2026-07-31_b76ef53ba08bfceaddf79bb2811cd9aa_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 225KB
Sample260731-c4mhtabd98
SHA256 a79fcc2b5d0b1f644b9351a326debf5f260cf00bcdf5af0e7dddd8d4663f0e0e
MD5 b76ef53ba08bfceaddf79bb2811cd9aa
SHA1 d3a016aaf3aaa72c2bcbb2670523cbfb4fbe8342
SHA512 49067c30a971673b550b12487cfed0c6375d3827121502f91ac3c551535d510ff69b8224ab4f920062cce61485af98aa146d6c1b934d3a6ae6e458051bafa13c
SSDEEP 3072:lKEvbAN/12IBpF5FuJBHotyOmEeZmTDFxVvA/uVPtDwDo34G3fUsauOBX:nv8N/12IxMHotyVER9Iw4MsdHB
TLSH
T196347B0B77A428E9E063667488A1D375E375BC210724D75F4BF08A377F36690AD2A7E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_b76ef53ba08bfceaddf79bb2811cd9aa_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-07-31_b76ef53ba08bfceaddf79bb2811cd9aa_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 225KB

2026-07-31_b76ef53ba08bfceaddf79bb2811cd9aa_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 3a5bf30b795ca60c8588f85f04f67ba5
SHA256 a79fcc2b5d0b1f644b9351a326debf5f260cf00bcdf5af0e7dddd8d4663f0e0e
MD5 b76ef53ba08bfceaddf79bb2811cd9aa
SHA1 d3a016aaf3aaa72c2bcbb2670523cbfb4fbe8342
SHA512 49067c30a971673b550b12487cfed0c6375d3827121502f91ac3c551535d510ff69b8224ab4f920062cce61485af98aa146d6c1b934d3a6ae6e458051bafa13c
SSDEEP 3072:lKEvbAN/12IBpF5FuJBHotyOmEeZmTDFxVvA/uVPtDwDo34G3fUsauOBX:nv8N/12IxMHotyVER9Iw4MsdHB
TLSH
T196347B0B77A428E9E063667488A1D375E375BC210724D75F4BF08A377F36690AD2A7E0
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

13092

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\programsource\gitee\process-hollowing2\x64\Release\runpe.pdb

kernel32

Wow64SetThreadContext Wow64GetThreadContext ResumeThread GetModuleHandleA CreateFileA GetSystemDirectoryA LoadLibraryA CloseHandle HeapAlloc VirtualProtectEx TerminateProcess GetProcAddress VirtualAllocEx GetFileSize ReadProcessMemory GetProcessHeap GetModuleHandleW FlushInstructionCache CreateProcessA SetThreadContext IsWow64Process WriteConsoleW HeapFree WriteProcessMemory GetThreadContext ReadFile ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_b76ef53ba08bfceaddf79bb2811cd9aa_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

kernel32

generic