2026-08-09_3b7d29bd3b0a2d4cc3cd8a0a078dee44_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

General

Target
2026-08-09_3b7d29bd3b0a2d4cc3cd8a0a078dee44_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 225KB
Sample260809-vhd9esan31
SHA256 2ad0736ab3592dfc15dfbad71941a34aa14f969c8410698d80420575cb6efc0b
MD5 3b7d29bd3b0a2d4cc3cd8a0a078dee44
SHA1 a98aed01017c1ca94154845d427826a30f1c4572
SHA512 7637b548a9c31db5982b0cb29955d2081dcedefc9e565fcf0112a06c1ed15ba947bf3e146509f60db1638d9123dbec504a156d6e4e67723d88d8497021b7a207
SSDEEP 3072:lKEvbAN/12IBpF5FuJBHotyOmEeZmTwFxVvA/uVPtDwDo34G3fUsauOBX:nv8N/12IxMHotyVEa9Iw4MsdHB
TLSH
T1C3347B0B77A428E9E063667488A1D375E375BC210724D75F4BF08A377F36690AD2A7E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_3b7d29bd3b0a2d4cc3cd8a0a078dee44_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-08-09_3b7d29bd3b0a2d4cc3cd8a0a078dee44_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 225KB

2026-08-09_3b7d29bd3b0a2d4cc3cd8a0a078dee44_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 3a5bf30b795ca60c8588f85f04f67ba5
SHA256 2ad0736ab3592dfc15dfbad71941a34aa14f969c8410698d80420575cb6efc0b
MD5 3b7d29bd3b0a2d4cc3cd8a0a078dee44
SHA1 a98aed01017c1ca94154845d427826a30f1c4572
SHA512 7637b548a9c31db5982b0cb29955d2081dcedefc9e565fcf0112a06c1ed15ba947bf3e146509f60db1638d9123dbec504a156d6e4e67723d88d8497021b7a207
SSDEEP 3072:lKEvbAN/12IBpF5FuJBHotyOmEeZmTwFxVvA/uVPtDwDo34G3fUsauOBX:nv8N/12IxMHotyVEa9Iw4MsdHB
TLSH
T1C3347B0B77A428E9E063667488A1D375E375BC210724D75F4BF08A377F36690AD2A7E0
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

13092

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\programsource\gitee\process-hollowing2\x64\Release\runpe.pdb

kernel32

Wow64SetThreadContext Wow64GetThreadContext ResumeThread GetModuleHandleA CreateFileA GetSystemDirectoryA LoadLibraryA CloseHandle HeapAlloc VirtualProtectEx TerminateProcess GetProcAddress VirtualAllocEx GetFileSize ReadProcessMemory GetProcessHeap GetModuleHandleW FlushInstructionCache CreateProcessA SetThreadContext IsWow64Process WriteConsoleW HeapFree WriteProcessMemory GetThreadContext ReadFile ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_3b7d29bd3b0a2d4cc3cd8a0a078dee44_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

kernel32

generic