2026-08-21_5fc36302d58f7a00d2ec1807b51b48ab_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-21_5fc36302d58f7a00d2ec1807b51b48ab_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 601KB
Sample260821-v6qmcsvbja
SHA256 e7a8a325fd2a898a70bd2c1294045829f4ae555e4abf463ab4e334c51c35e46a
MD5 5fc36302d58f7a00d2ec1807b51b48ab
SHA1 51be55ee1c9ca20ff33bc2d0c6cbd8f675d61373
SHA512 c984d7173bc58466e5d05c5001e2dbf7fdbeae5bf12c556703e255539a051030ab2b34cdb69d72b4f819934fb28f02234eeebffd8ed20737e03e0e194bf4dbf3
SSDEEP 6144:E7J4rsDA648KfNaAxe0Jv9W/T58rUp5G16D9VpTCmpQb3dWKRqbisrOHrgtas37:iJ464QAxe0Ja5vpo1oempodZRq/a0
TLSH
T10AD46D1AA6A842F4D5BBE078C481511AFA7174EA533067CB93E15A9B1F63BF05F3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_5fc36302d58f7a00d2ec1807b51b48ab_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-08-21_5fc36302d58f7a00d2ec1807b51b48ab_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 601KB

2026-08-21_5fc36302d58f7a00d2ec1807b51b48ab_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 334e45abe6be0eefce06132c128da4e0
SHA256 e7a8a325fd2a898a70bd2c1294045829f4ae555e4abf463ab4e334c51c35e46a
MD5 5fc36302d58f7a00d2ec1807b51b48ab
SHA1 51be55ee1c9ca20ff33bc2d0c6cbd8f675d61373
SHA512 c984d7173bc58466e5d05c5001e2dbf7fdbeae5bf12c556703e255539a051030ab2b34cdb69d72b4f819934fb28f02234eeebffd8ed20737e03e0e194bf4dbf3
SSDEEP 6144:E7J4rsDA648KfNaAxe0Jv9W/T58rUp5G16D9VpTCmpQb3dWKRqbisrOHrgtas37:iJ464QAxe0Ja5vpo1oempodZRq/a0
TLSH
T10AD46D1AA6A842F4D5BBE078C481511AFA7174EA533067CB93E15A9B1F63BF05F3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

255952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2014_D20250424T154739\fa_rss\AppStoreUpdater\Release\auto_updater.pdb

kernel32

HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection FindResourceExW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar GetCommandLineW GetCurrentDirectoryW CreateDirectoryW DeleteFileW HeapAlloc FindFirstFileW FindNextFileW GetFileAttributesW RemoveDirectoryW CloseHandle WaitForSingleObject CreateEventW OpenEventW CreateProcessW GetTickCount GetTickCount64 WideCharToMultiByte WriteConsoleW SetEndOfFile CreateFileW SetStdHandle HeapDestroy GetLastError FindClose DecodePointer SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId EnterCriticalSection LeaveCriticalSection EncodePointer GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LocalFree GetLocaleInfoEx LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead GetCurrentProcess TerminateProcess RtlPcToFileHeader RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetFileType FlsAlloc RtlUnwind

user32

wsprintfW

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

shell32

CommandLineToArgvW

ole32

CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear

urlmon

URLDownloadToFileW

rpcrt4

UuidCreate RpcStringFreeW UuidToStringW

winhttp

WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpReceiveResponse WinHttpOpen WinHttpCloseHandle WinHttpConnect

wininet

InternetCheckConnectionW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_5fc36302d58f7a00d2ec1807b51b48ab_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

kernel32

user32

advapi32

shell32

ole32

oleaut32

urlmon

rpcrt4

winhttp

wininet

generic