2026-08-19_5888a337cd000fee20b5fda5eec7f12f_cobalt-strike_hijackloader_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_5888a337cd000fee20b5fda5eec7f12f_cobalt-strike_hijackloader_icedid_njrat_satacom_stealc_vidar
Size 2.7MB
Sample260819-swmrlsdl21
SHA256 8984febf41451bb69a8391317e729ca7da2b9762134f92925607c2d3f1530770
MD5 5888a337cd000fee20b5fda5eec7f12f
SHA1 abaa2cc1093fe38eb064a4b8f636afb0cdf219db
SHA512 fb23277e89975f28b50e344682d7e76311db8d1c2d7a3b471ce81a7a8d0e30d0254ddf7da8d717e3fd7ac8551dda715424a33b3f859fe21e643eacb29c2c56f8
SSDEEP 24576:Oc+qILkhdIdcN/vvtTObMceJhYdJSjgHyo7IbmHKQYei:kYdI+vtTMMHJ2dokSobqlP
TLSH
T183D5D06473E400F9E1B3923499639A0AE3717D460B62D7CF4290FA761F37A924E39F61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_5888a337cd000fee20b5fda5eec7f12f_cobalt-strike_hijackloader_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-08-19_5888a337cd000fee20b5fda5eec7f12f_cobalt-strike_hijackloader_icedid_njrat_satacom_stealc_vidar

.exe 2.7MB

2026-08-19_5888a337cd000fee20b5fda5eec7f12f_cobalt-strike_hijackloader_icedid_njrat_satacom_stealc_vidar

IMPHASH 3fc02599def37af155fc4f24ccae1848
SHA256 8984febf41451bb69a8391317e729ca7da2b9762134f92925607c2d3f1530770
MD5 5888a337cd000fee20b5fda5eec7f12f
SHA1 abaa2cc1093fe38eb064a4b8f636afb0cdf219db
SHA512 fb23277e89975f28b50e344682d7e76311db8d1c2d7a3b471ce81a7a8d0e30d0254ddf7da8d717e3fd7ac8551dda715424a33b3f859fe21e643eacb29c2c56f8
SSDEEP 24576:Oc+qILkhdIdcN/vvtTObMceJhYdJSjgHyo7IbmHKQYei:kYdI+vtTMMHJ2dokSobqlP
TLSH
T183D5D06473E400F9E1B3923499639A0AE3717D460B62D7CF4290FA761F37A924E39F61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

180700

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\bugreport\Output\PdbFinal\bugreport.pdb

dbghelp

SymCleanup SymGetModuleInfoW64 SymSetOptions SymInitialize SymLoadModule64 MiniDumpWriteDump StackWalk64 SymFunctionTableAccess64

tinyxml

?ToDeclaration@TiXmlNode@@UEAAPEAVTiXmlDeclaration@@XZ ?Clone@TiXmlDocument@@MEBAPEAVTiXmlNode@@XZ ?ToText@TiXmlNode@@UEAAPEAVTiXmlText@@XZ ?ToUnknown@TiXmlNode@@UEBAPEBVTiXmlUnknown@@XZ ?ToUnknown@TiXmlNode@@UEAAPEAVTiXmlUnknown@@XZ ?ToComment@TiXmlNode@@UEBAPEBVTiXmlComment@@XZ ?ToComment@TiXmlNode@@UEAAPEAVTiXmlComment@@XZ ?ToElement@TiXmlNode@@UEBAPEBVTiXmlElement@@XZ ?ToElement@TiXmlNode@@UEAAPEAVTiXmlElement@@XZ ?ToDocument@TiXmlDocument@@UEBAPEBV1@XZ ?ToDocument@TiXmlDocument@@UEAAPEAV1@XZ ?Print@TiXmlDocument@@UEBAXPEAU_iobuf@@H@Z ?GetText@TiXmlElement@@QEBAPEBDXZ ?NextSiblingElement@TiXmlNode@@QEAAPEAVTiXmlElement@@XZ ?Value@TiXmlNode@@QEBAPEBDXZ ??1TiXmlDocument@@UEAA@XZ ?FirstChildElement@TiXmlNode@@QEAAPEAVTiXmlElement@@XZ ?RootElement@TiXmlDocument@@QEAAPEAVTiXmlElement@@XZ ?Parse@TiXmlDocument@@UEAAPEBDPEBDPEAVTiXmlParsingData@@W4TiXmlEncoding@@@Z ??0TiXmlDocument@@QEAA@XZ ?Accept@TiXmlDocument@@UEBA_NPEAVTiXmlVisitor@@@Z ?LoadFile@TiXmlDocument@@QEAA_NPEB_WW4TiXmlEncoding@@@Z ?Attribute@TiXmlElement@@QEBAPEBDPEBD@Z ?ToDeclaration@TiXmlNode@@UEBAPEBVTiXmlDeclaration@@XZ ?ToText@TiXmlNode@@UEBAPEBVTiXmlText@@XZ

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wininet

HttpSendRequestA InternetOpenA InternetReadFile InternetOpenUrlA HttpOpenRequestA InternetConnectA InternetCloseHandle

psapi

GetModuleFileNameExW GetModuleFileNameExA

comctl32

ImageList_Create ImageList_ReplaceIcon InitCommonControlsEx

kernel32

LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread GetCommandLineA LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer SetLastError RtlPcToFileHeader RtlUnwindEx GetConsoleMode ReadConsoleW GetConsoleOutputCP GetFileSizeEx GetStringTypeW FindFirstFileExW HeapAlloc GetProcessHeap GetModuleHandleW HeapDestroy HeapSize HeapReAlloc HeapFree SetErrorMode MultiByteToWideChar GetCommandLineW GetTickCount SetCurrentDirectoryW ReadProcessMemory WriteProcessMemory CloseHandle OpenProcess GetLastError VirtualQueryEx CreateFileA GetWindowsDirectoryW GetModuleFileNameW OpenThread CreateThread GetLocalTime TerminateProcess SetEvent CreateProcessW FreeLibrary WaitForSingleObject lstrcatW IsValidCodePage CopyFileW LoadLibraryW FindFirstFileW FindNextFileW FindClose lstrcpyW WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceExW FindResourceW GlobalAlloc GlobalLock GlobalUnlock GlobalFree Sleep IsDBCSLeadByte FileTimeToSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime ResumeThread FreeResource CreateEventW GetFileAttributesW CreateFileW GetProcAddress CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteFile InitializeCriticalSectionAndSpinCount RaiseException DeleteCriticalSection GetPrivateProfileSectionW GetSystemDefaultLCID ReadFile SetFilePointer GetTempPathW CreateDirectoryW GetVersionExW GetFileSize GetPrivateProfileIntW WritePrivateProfileStringW GetCurrentProcessId GetCurrentThreadId MoveFileW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection QueryPerformanceCounter GetProcessTimes GetCurrentProcess GetSystemTimeAsFileTime SetFileAttributesW DeviceIoControl lstrlenW IsDebuggerPresent OutputDebugStringW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetFilePointerEx SetStdHandle FlushFileBuffers SetEndOfFile WriteConsoleW DeleteFileW InitializeSListHead

user32

DrawTextW ReleaseDC GetGuiResources IsWindow SetWindowLongPtrW CreatePopupMenu TrackPopupMenu DestroyMenu DefWindowProcW GetClassInfoExW RegisterClassExW CreateWindowExW DestroyWindow GetSystemMenu EnableWindow SendDlgItemMessageW SetTimer CallWindowProcW GetDC GetWindowTextLengthW GetDesktopWindow PostMessageW EnumChildWindows GetWindowLongPtrW EnumWindows GetClassNameW GetWindowTextW GetWindowThreadProcessId EndPaint BeginPaint DialogBoxParamW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard DrawIconEx GetClientRect ShowWindow LoadImageW SetWindowPos RegisterClipboardFormatW InvalidateRect MapDialogRect GetWindowRect MapWindowPoints SetWindowLongW SetWindowTextW SendMessageW LoadIconW EndDialog ClientToScreen KillTimer GetDlgItem GetSysColorBrush SetDlgItemTextW EnableMenuItem GetMenuItemID GetKeyState GetMenuItemCount

gdi32

SelectObject GetStockObject SetTextColor CreateFontW DeleteObject SetBkMode

advapi32

RegSetValueExW RegDeleteValueW RegCreateKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

SHGetSpecialFolderPathW ShellExecuteW ShellExecuteExW ord155 SHBindToParent SHGetDesktopFolder SHGetFileInfoW

ole32

DoDragDrop OleUninitialize OleInitialize CreateStreamOnHGlobal

oleaut32

SysStringByteLen SysAllocStringByteLen SysAllocString SysFreeString SysStringLen

gdiplus

GdipImageSelectActiveFrame GdipGetPropertyItem GdipGetPropertyItemSize GdipImageGetFrameDimensionsCount GdipAlloc GdipFree GdiplusStartup GdiplusShutdown GdipCreateFromHDC GdipDeleteGraphics GdipCloneImage GdipDisposeImage GdipDrawImageRectI GdipGetImageHeight GdipGetImageWidth GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipLoadImageFromStreamICM

shlwapi

PathFileExistsW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

crypt32

CertGetNameStringW

wintrust

WTHelperGetProvCertFromChain WinVerifyTrust WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain

iphlpapi

GetAdaptersInfo GetAdaptersAddresses

netapi32

Netbios

Name

.text

Size

330KB

Virtual Size

329KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

110KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=8, id=259, version=28900,

count=177, id=261, version=28900,

count=19, id=260, version=30034,

count=10, id=259, version=30034,

count=46, id=261, version=30034,

count=2, id=261, version=30625,

count=1, id=263, version=28900,

count=13, id=260, version=28900,

count=1, id=262, version=28900,

count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,

count=41, id=257, version=28900,

count=338, id=1, productName=Unmarked objects,

count=8, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=2, id=158, productName=VS2010 SP1 build 40219, version=40219,

count=24, id=265, version=30136,

count=1, id=255, productName=VS2019 v16.11.5 build 30136, version=30136,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.11.5 build 30136, version=30136,