2026-09-04_aa98470f9ea7503d8e0b643af658b006_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

General

Target
2026-09-04_aa98470f9ea7503d8e0b643af658b006_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 225KB
Sample260905-a5mtvscl7y
SHA256 4bf23a7dc6c73a1325f6e3fe8996bfc9287b4d88f6c79a0d76572b0deae8fc78
MD5 aa98470f9ea7503d8e0b643af658b006
SHA1 46230b3cdc049d74248991decbbeacc895718978
SHA512 7af52feacafc5857ddffad679f15a136ecbbe84bf63befb5ef8e0c8aa1aceac920f45ada1e7a7b1fe21e0abbefde46565eae446552b54b4b39c62ad266951a1f
SSDEEP 3072:lKEvbAN/12IBpF5FuJBHotyOmEeZmToFxVvA/uVPtDwDo34G3fUsauOBX:nv8N/12IxMHotyVES9Iw4MsdHB
TLSH
T105347B0B77A428E9E063667488A1D375E375BC210724D75F4BF08A377F36690AD2A7E0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_aa98470f9ea7503d8e0b643af658b006_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-09-04_aa98470f9ea7503d8e0b643af658b006_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 225KB

2026-09-04_aa98470f9ea7503d8e0b643af658b006_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 3a5bf30b795ca60c8588f85f04f67ba5
SHA256 4bf23a7dc6c73a1325f6e3fe8996bfc9287b4d88f6c79a0d76572b0deae8fc78
MD5 aa98470f9ea7503d8e0b643af658b006
SHA1 46230b3cdc049d74248991decbbeacc895718978
SHA512 7af52feacafc5857ddffad679f15a136ecbbe84bf63befb5ef8e0c8aa1aceac920f45ada1e7a7b1fe21e0abbefde46565eae446552b54b4b39c62ad266951a1f
SSDEEP 3072:lKEvbAN/12IBpF5FuJBHotyOmEeZmToFxVvA/uVPtDwDo34G3fUsauOBX:nv8N/12IxMHotyVES9Iw4MsdHB
TLSH
T105347B0B77A428E9E063667488A1D375E375BC210724D75F4BF08A377F36690AD2A7E0
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

13092

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\programsource\gitee\process-hollowing2\x64\Release\runpe.pdb

kernel32

Wow64SetThreadContext Wow64GetThreadContext ResumeThread GetModuleHandleA CreateFileA GetSystemDirectoryA LoadLibraryA CloseHandle HeapAlloc VirtualProtectEx TerminateProcess GetProcAddress VirtualAllocEx GetFileSize ReadProcessMemory GetProcessHeap GetModuleHandleW FlushInstructionCache CreateProcessA SetThreadContext IsWow64Process WriteConsoleW HeapFree WriteProcessMemory GetThreadContext ReadFile ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_aa98470f9ea7503d8e0b643af658b006_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

kernel32

generic