2026-10-25_a155c0b112638bcf5f0275ec416abf14_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_a155c0b112638bcf5f0275ec416abf14_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar
Size 1.4MB
Sample261026-weelfsbf36
SHA256 c7d21896440e6d15973b545c9dada23000ab49b14e3651c2fd10dac2004f7571
MD5 a155c0b112638bcf5f0275ec416abf14
SHA1 ff99350323d46d67585c2f11843d94b05eeaf820
SHA512 563d5793cfefef12ce1a6df54277ef69661baaef2b5d667bf35a81aac1b2e0bcef0e70ecdc1cdba5f18481b205cad9936f856c89656f299ac1db77e09f4d6b5b
SSDEEP 24576:vx8/NJxoxooo5p2uZSFClYGyKlIsDLZ8ZjCR97cJIUl694IjviDT:vx8/NPoxooo5p5SF0vKmujo9cp0SIjvq
TLSH
T12C657D0572ED01D8E4B7E17AC9324956E6B13C160B318ADF02A0BB5B2F37AD15E7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_a155c0b112638bcf5f0275ec416abf14_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

File Explorer

2026-10-25_a155c0b112638bcf5f0275ec416abf14_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

.exe 1.4MB

2026-10-25_a155c0b112638bcf5f0275ec416abf14_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

IMPHASH 07e88317f34f58d5590c51bdefca4546
SHA256 c7d21896440e6d15973b545c9dada23000ab49b14e3651c2fd10dac2004f7571
MD5 a155c0b112638bcf5f0275ec416abf14
SHA1 ff99350323d46d67585c2f11843d94b05eeaf820
SHA512 563d5793cfefef12ce1a6df54277ef69661baaef2b5d667bf35a81aac1b2e0bcef0e70ecdc1cdba5f18481b205cad9936f856c89656f299ac1db77e09f4d6b5b
SSDEEP 24576:vx8/NJxoxooo5p2uZSFClYGyKlIsDLZ8ZjCR97cJIUl694IjviDT:vx8/NPoxooo5p5SF0vKmujo9cp0SIjvq
TLSH
T12C657D0572ED01D8E4B7E17AC9324956E6B13C160B318ADF02A0BB5B2F37AD15E7EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1507328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\runner\builds\glrt-t3_\0\V3_Installer\BaseInstaller\BIBuilds\x64\Release\UNINSTAL.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

shlwapi

PathAddBackslashW PathStripToRootW PathIsUNCW PathFindExtensionW PathFindFileNameW PathFileExistsW SHDeleteKeyW

mscms

GetColorDirectoryW EnumColorProfilesW

setupapi

SetupFindFirstLineW SetupOpenInfFileW SetupGetStringFieldW SetupFindNextLine SetupCloseInfFile SetupGetLineTextW SetupDiGetClassDevsW SetupGetLineByIndexW SetupDiGetDeviceRegistryPropertyW CM_Get_Parent SetupDiDestroyDeviceInfoList CM_Get_DevNode_Status CM_Get_DevNode_Registry_PropertyW CM_Get_Device_IDW SetupDiClassGuidsFromNameW SetupDiEnumDeviceInfo

kernel32

CompareStringA FileTimeToLocalFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime InitializeCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GlobalReAlloc GlobalHandle LocalReAlloc GetCurrentProcessId GetSystemDefaultUILanguage GlobalFlags GetCurrentDirectoryW FlushFileBuffers GetFullPathNameW GetVolumeInformationW ReadFile SetEndOfFile SetErrorMode GetCurrentThread GetFileSizeEx GetUserDefaultLCID ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW SuspendThread SetThreadPriority CreateEventW SetEvent CompareStringW GlobalFindAtomW GlobalAddAtomW GlobalDeleteAtom GetCurrentThreadId EncodePointer lstrcmpA MulDiv GlobalLock GlobalUnlock QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW GetModuleHandleExW InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection OutputDebugStringA GetACP OutputDebugStringW WriteFile SetFilePointer GetFileTime GetFileAttributesW WideCharToMultiByte LocalAlloc GetComputerNameW IsWow64Process ExitThread FreeLibraryAndExitThread GetCommandLineA HeapQueryInformation GetStdHandle ExitProcess GetFileType GetTimeZoneInformation FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW LCMapStringW IsValidLocale EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode SetFilePointerEx ReadConsoleW GetDriveTypeW FindFirstFileExW GetVersionExW GetCurrentProcess GetSystemInfo lstrcmpW lstrcmpiW SetCurrentDirectoryW GetExitCodeThread ResumeThread LoadLibraryExW CopyFileW GetLocaleInfoW CreateMutexW GetUserDefaultUILanguage GetCommandLineW CreateDirectoryW OpenMutexW VerifyVersionInfoW VerSetConditionMask GetExitCodeProcess CreateProcessW MoveFileExW CloseHandle Sleep SetFileAttributesW OpenProcess CreateFileW WaitForSingleObject GetTempPathW TerminateProcess lstrcpynW FindNextFileW GetWindowsDirectoryW FindClose FindFirstFileW GetModuleHandleW lstrcatW GetPrivateProfileSectionW lstrlenW SetLastError LocalFree FormatMessageW MultiByteToWideChar GetModuleFileNameW DeleteFileW RemoveDirectoryW GetPrivateProfileStringW GetPrivateProfileIntW WritePrivateProfileStringW lstrcpyW FreeLibrary FindResourceW LoadResource GlobalFree GlobalAlloc LockResource SizeofResource GetProcessHeap DeleteCriticalSection GetProcAddress DecodePointer HeapAlloc LoadLibraryW HeapReAlloc GetLastError HeapSize GetSystemDirectoryW InitializeCriticalSectionEx HeapFree CreateThread GetLocalTime RtlUnwind RtlPcToFileHeader RtlUnwindEx GetCPInfo LCMapStringEx GetStringTypeW GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException SetEnvironmentVariableW SetStdHandle GetFileAttributesExW WriteConsoleW IsValidCodePage

user32

GetWindowTextW RemovePropW GetPropW SetPropW GetScrollPos ValidateRect EndPaint BeginPaint SetActiveWindow SetMenu GetMenu GetCapture GetKeyState GetFocus SetFocus GetDlgCtrlID GetDlgItem IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos SetWindowPos DestroyWindow IsChild IsMenu IsWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos AdjustWindowRectEx GetMenuItemCount GetMenuItemID GetSubMenu OffsetRect SetRectEmpty SendDlgItemMessageA DrawIcon DispatchMessageW RedrawWindow PeekMessageW TranslateMessage UpdateWindow InvalidateRect IsIconic PostMessageW FindWindowW GetDC MessageBoxW GetSystemMetrics DestroyIcon GetSysColor GetDesktopWindow ReleaseDC GetWindowRect LoadCursorW SetCursor SetForegroundWindow GetWindowLongW SetWindowLongW GetClientRect GetForegroundWindow GetParent SendMessageW LoadIconW EnableWindow wsprintfW UnregisterClassW ScreenToClient MapWindowPoints CopyRect PtInRect GetWindowLongPtrW SetWindowLongPtrW GetClassLongPtrW GetClassNameW GetTopWindow GetLastActivePopup GetWindow SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx WinHelpW MonitorFromWindow GetMonitorInfoW ShowWindow SetDlgItemTextW GetWindowTextLengthW IsWindowEnabled SetWindowTextW IsDialogMessageW CreateDialogIndirectParamW EndDialog GetNextDlgTabItem GetActiveWindow CheckMenuItem EnableMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions SetMenuItemInfoW LoadBitmapW DrawTextW DrawTextExW GrayStringW TabbedTextOutW ClientToScreen GetMessageW GetCursorPos PostQuitMessage GetSysColorBrush GetWindowThreadProcessId DestroyMenu CharUpperW KillTimer SetTimer RealChildWindowFromPoint RegisterWindowMessageW

gdi32

RestoreDC SaveDC SelectObject SetMapMode RectVisible ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx OffsetViewportOrgEx ScaleViewportExtEx ScaleWindowExtEx GetStockObject PtVisible TextOutW GetClipBox Escape DeleteObject CreateBitmap GetObjectW CreateCompatibleDC GetDeviceCaps SetTextColor SetBkColor DeleteDC CreateCompatibleBitmap

winspool.drv

SetPrinterW AddPrinterW DeletePrinter DeletePrinterConnectionW ClosePrinter OpenPrinterW EnumPortsW EnumPrintersW GetPrinterDataExW EnumPrinterDriversW GetPrintProcessorDirectoryW DeletePrintProcessorW EnumPrintProcessorsW GetPrinterDriverDirectoryW DeleteMonitorW GetPrinterW GetPrinterDriverW AddMonitorW EnumMonitorsW DocumentPropertiesW

advapi32

RegQueryValueW RegEnumKeyW StartServiceW ControlService FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids RegQueryInfoKeyW QueryServiceStatus CloseServiceHandle OpenSCManagerW EnumDependentServicesW QueryServiceConfigW OpenServiceW RegCloseKey RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegEnumValueW RegQueryValueExW RegDeleteKeyW TraceMessage

shell32

ShellExecuteW SHGetSpecialFolderLocation ExtractIconExW SHGetPathFromIDListW SHGetMalloc

comctl32

ImageList_GetIcon ImageList_Draw ImageList_Add ImageList_ReplaceIcon ord17

ole32

CoInitialize CoTaskMemAlloc CoTaskMemFree CoCreateGuid CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysAllocString VariantChangeType VariantClear VariantInit

oleacc

CreateStdAccessibleObject LresultFromObject

Name

.text

Size

821KB

Virtual Size

821KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

235KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

308KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.zero

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_a155c0b112638bcf5f0275ec416abf14_cobalt-strike_hijackloader_icedid_luca-stealer_njrat_satacom_stealc_vidar

version

shlwapi

mscms

setupapi

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

ole32

oleaut32

oleacc

generic