2026-09-30_b02fd26e2351dc1faa6032fcadad29f0_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_b02fd26e2351dc1faa6032fcadad29f0_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar
Size 2.8MB
Sample260930-kh4tzasgpf
SHA256 7f6b3dc3ef73a69c2d2dc9b3645946a8af2adf26457e892a749d03fb27fcac2e
MD5 b02fd26e2351dc1faa6032fcadad29f0
SHA1 e6a3ac3f833e96ebdbe80365561f1a022cf24386
SHA512 f46a4e828b11d289322b88de6f1ad270203927ddaa582c0f0ccd8c0e9510d5d06f2a3655f964f0e44536734e706084d3aad9477309517ad534fb9a37788d8517
SSDEEP 49152:HzOxwt9F+7FiB+cfRWkkjY5qUHj1FhW825PlJ0TJctF:H+w87XsWkkjaHjTo82Pb0cb
TLSH
T145D5120B669102F9E0BBD139CA454E55FBB6B81A0720D7CB03E456A22F237E15F7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-30_b02fd26e2351dc1faa6032fcadad29f0_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar

File Explorer

2026-09-30_b02fd26e2351dc1faa6032fcadad29f0_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar

.exe 2.8MB

2026-09-30_b02fd26e2351dc1faa6032fcadad29f0_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar

IMPHASH 92f0faeca8f1c4d9dc76901b4b937442
SHA256 7f6b3dc3ef73a69c2d2dc9b3645946a8af2adf26457e892a749d03fb27fcac2e
MD5 b02fd26e2351dc1faa6032fcadad29f0
SHA1 e6a3ac3f833e96ebdbe80365561f1a022cf24386
SHA512 f46a4e828b11d289322b88de6f1ad270203927ddaa582c0f0ccd8c0e9510d5d06f2a3655f964f0e44536734e706084d3aad9477309517ad534fb9a37788d8517
SSDEEP 49152:HzOxwt9F+7FiB+cfRWkkjY5qUHj1FhW825PlJ0TJctF:H+w87XsWkkjaHjTo82Pb0cb
TLSH
T145D5120B669102F9E0BBD139CA454E55FBB6B81A0720D7CB03E456A22F237E15F7E321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

a3:21:0c:be:75:cf:70:7f:52:f2:87:b0:68:a2:54:a6:49:7f:a3:7f:59:70:38:17:50:e3:b6:54:a6:99:82:a7

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=0108-01-003186,CN=Canon Inc.,O=Canon Inc.,L=Ota-Ku,ST=Tokyo,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

Chains

Feb 7, 2025

SERIALNUMBER=0108-01-003186,CN=Canon Inc.,O=Canon Inc.,L=Ota-Ku,ST=Tokyo,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=0108-01-003186,CN=Canon Inc.,O=Canon Inc.,L=Ota-Ku,ST=Tokyo,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=0108-01-003186,CN=Canon Inc.,O=Canon Inc.,L=Ota-Ku,ST=Tokyo,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

Serial Number

06:61:56:60:1a:37:7c:91:9b:42:07:b2:c4:c0:5a:08

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 17, 2024 - Sep 17, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

90116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\LibraryV290\drvDIAS_Release\Dias\installer\UninstExe\Release\x64\DiasUninst.pdb

advapi32

OpenServiceA RegEnumKeyExA RegDeleteValueA RegEnumValueA RegOpenKeyExA StartServiceA ControlService DeleteService RegFlushKey OpenSCManagerA RegQueryValueExA CloseServiceHandle RegDeleteKeyA QueryServiceStatus RegCloseKey EnumDependentServicesA

kernel32

FindFirstFileA OutputDebugStringA FindNextFileA FindClose lstrcmpA GetModuleHandleA GetCommandLineA Sleep GetLastError GetFileAttributesA MoveFileExA GetSystemDirectoryA DeleteFileA CloseHandle SetFileAttributesA GetProcAddress RemoveDirectoryA InitializeCriticalSectionEx MultiByteToWideChar WriteConsoleW CreateFileW ReadConsoleW ReadFile SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetStringTypeW SetStdHandle OutputDebugStringW SetConsoleCtrlHandler WideCharToMultiByte LocalFree RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCurrentThread HeapFree HeapAlloc FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetProcessHeap GetFileType

user32

wsprintfA MessageBoxA

ole32

CoInitializeEx CoCreateInstance CoUninitialize

oleaut32

VariantInit SysFreeString SysAllocString SysStringLen VariantChangeType VariantClear SetErrorInfo GetErrorInfo CreateErrorInfo

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_b02fd26e2351dc1faa6032fcadad29f0_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_stealc_vidar

PE Signature issue

advapi32

kernel32

user32

ole32

oleaut32

generic