2026-09-06_710851234a2ff37807888c5b4b15fe58_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

General

Target
2026-09-06_710851234a2ff37807888c5b4b15fe58_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
Size 158KB
Sample260907-bexf2swbrf
SHA256 7ff8827aa03be13bd5452bc9b56e0baab7317980afbb40e46fc06403a95dbe35
MD5 710851234a2ff37807888c5b4b15fe58
SHA1 f79002f87b33f4143d6149ca3fe369ffe36709d0
SHA512 37d7597547754ce5a5c4c16da3044fdc83348e5d5b1c4bea596d6e819f82dec97787e6432dc37eac5ffda259e5f1618fc2ffa6d9ee355e9c5a207fbbe68ae6c5
SSDEEP 3072:VKEvbAN/12IBpF5FuJBHotyOmEeZmTOFxVvA/:3v8N/12IxMHotyVEU9
TLSH
T10BF36C1BB3A430F9E0778275C8910646E7B6B83507249B9F07A4477A2F73690DD3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-06_710851234a2ff37807888c5b4b15fe58_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

File Explorer

2026-09-06_710851234a2ff37807888c5b4b15fe58_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

.exe 158KB

2026-09-06_710851234a2ff37807888c5b4b15fe58_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

IMPHASH 3a5bf30b795ca60c8588f85f04f67ba5
SHA256 7ff8827aa03be13bd5452bc9b56e0baab7317980afbb40e46fc06403a95dbe35
MD5 710851234a2ff37807888c5b4b15fe58
SHA1 f79002f87b33f4143d6149ca3fe369ffe36709d0
SHA512 37d7597547754ce5a5c4c16da3044fdc83348e5d5b1c4bea596d6e819f82dec97787e6432dc37eac5ffda259e5f1618fc2ffa6d9ee355e9c5a207fbbe68ae6c5
SSDEEP 3072:VKEvbAN/12IBpF5FuJBHotyOmEeZmTOFxVvA/:3v8N/12IxMHotyVEU9
TLSH
T10BF36C1BB3A430F9E0778275C8910646E7B6B83507249B9F07A4477A2F73690DD3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

13092

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\programsource\gitee\process-hollowing2\x64\Release\runpe.pdb

kernel32

Wow64SetThreadContext Wow64GetThreadContext ResumeThread GetModuleHandleA CreateFileA GetSystemDirectoryA LoadLibraryA CloseHandle HeapAlloc VirtualProtectEx TerminateProcess GetProcAddress VirtualAllocEx GetFileSize ReadProcessMemory GetProcessHeap GetModuleHandleW FlushInstructionCache CreateProcessA SetThreadContext IsWow64Process WriteConsoleW HeapFree WriteProcessMemory GetThreadContext ReadFile ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-06_710851234a2ff37807888c5b4b15fe58_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar

kernel32

generic