2026-09-10_646eb11a93f5b255a528b46aae2a4465_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_646eb11a93f5b255a528b46aae2a4465_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 286KB
Sample260910-thcvxssbqb
SHA256 5017c3955873a9e8c1a6bc9073385e319019935a59b4f3e436d0cc9f6449c3f0
MD5 646eb11a93f5b255a528b46aae2a4465
SHA1 48b2712fd81c0a5aeb8c1c5f29a4cc101d336daa
SHA512 17d08f234d435163ec55439cdc40a08f5002c1ba2b6e2e376c34d0540575efa49f2201dd670f4dc8929fb83f20b71279f515e0a9107de3c625bf9d0cf437f9e9
SSDEEP 3072:XmTGizQ8x11SwEpAgNQlTkGixObSY1QNwfeaa1m3XXz7pzGgQd3zsobxZDRaY0W7:vizpzqISWawfVj3nzdGjsYtasOM
TLSH
T1F454184E7AA40CE9CDBBD07D9441116AF97174F68360E7CBA396521B1F63AE0AD3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-10_646eb11a93f5b255a528b46aae2a4465_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 286KB

2026-09-10_646eb11a93f5b255a528b46aae2a4465_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 31762f3046ebee3581f2d67cf3830e01
SHA256 5017c3955873a9e8c1a6bc9073385e319019935a59b4f3e436d0cc9f6449c3f0
MD5 646eb11a93f5b255a528b46aae2a4465
SHA1 48b2712fd81c0a5aeb8c1c5f29a4cc101d336daa
SHA512 17d08f234d435163ec55439cdc40a08f5002c1ba2b6e2e376c34d0540575efa49f2201dd670f4dc8929fb83f20b71279f515e0a9107de3c625bf9d0cf437f9e9
SSDEEP 3072:XmTGizQ8x11SwEpAgNQlTkGixObSY1QNwfeaa1m3XXz7pzGgQd3zsobxZDRaY0W7:vizpzqISWawfVj3nzdGjsYtasOM
TLSH
T1F454184E7AA40CE9CDBBD07D9441116AF97174F68360E7CBA396521B1F63AE0AD3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

a6:7c:40:2a:2e:00:b3:09:93:75:a2:e5:56:ad:65:b0:8a:dd:0e:be:c4:1f:0e:6c:1f:95:53:4d:b3:e7:d0:9b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Nov 13, 2024

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

0e:5c:65:5e:1c:be:9a:88:79:37:2f:58:a5:bc:03:02

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 8, 2024 - Feb 13, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

78364

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2001g_D20241113T092744\fa_rss\Watchdog\x64\Release\Watchdog.pdb

urlmon

URLDownloadToFileW

winhttp

WinHttpOpen WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpConnect WinHttpCloseHandle

kernel32

GetConsoleOutputCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW CreateFileW GetFileSize ReadFile CloseHandle GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree GetConsoleMode GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection FindResourceExW GetModuleFileNameW LoadResource LockResource SizeofResource FindResourceW CreateToolhelp32Snapshot Process32FirstW Process32NextW Sleep GetCommandLineA GetOEMCP GetACP WriteConsoleW HeapSize IsValidCodePage SetFilePointerEx QueryPerformanceCounter LocalFree FormatMessageA GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte GetCurrentThreadId GetSystemTimeAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RtlUnwindEx SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW SetEnvironmentVariableW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetCPInfo ExitProcess GetStdHandle WriteFile GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetStringTypeW

advapi32

RegCreateKeyW RegCloseKey RegQueryValueExW

shell32

CommandLineToArgvW SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_646eb11a93f5b255a528b46aae2a4465_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

urlmon

winhttp

kernel32

advapi32

shell32

generic