2026-03-13_640464354fe4e5679611c483f95f7c3c_cobalt-strike_icedid_satacom_vidar

General

Target
2026-03-13_640464354fe4e5679611c483f95f7c3c_cobalt-strike_icedid_satacom_vidar
Size 111KB
Sample260313-e9199sht8t
SHA256 4ae933ea4c0a65ea088fe1a715f8b23eabedf8f2bb0b7d22c0e967234ad696e4
MD5 640464354fe4e5679611c483f95f7c3c
SHA1 9f2593f88559ca8c4e573e2c625ca2b62766dd9c
SHA512 ff31b988fd59b0275db010bdaf52c1760b3954fa96b617cedb013470ad58fc2faba78eb1b19ad919b9e470348b6fdea51caf0798fe91fbe032413c2d81c98de3
SSDEEP 3072:qChA2adEHppUN/E4100rpVcZQjxmmtR1rrgRW:7b5UN/Eu00zcZ0mmPdr
TLSH
T1A4B3495972E900F9E077C339C8611A05E7B7F86247619FEF03A4426A1F63AD18D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-03-13_640464354fe4e5679611c483f95f7c3c_cobalt-strike_icedid_satacom_vidar

File Explorer

2026-03-13_640464354fe4e5679611c483f95f7c3c_cobalt-strike_icedid_satacom_vidar

.exe 111KB

2026-03-13_640464354fe4e5679611c483f95f7c3c_cobalt-strike_icedid_satacom_vidar

IMPHASH 7a94fb94fd4305abf98d937c11ad1b58
SHA256 4ae933ea4c0a65ea088fe1a715f8b23eabedf8f2bb0b7d22c0e967234ad696e4
MD5 640464354fe4e5679611c483f95f7c3c
SHA1 9f2593f88559ca8c4e573e2c625ca2b62766dd9c
SHA512 ff31b988fd59b0275db010bdaf52c1760b3954fa96b617cedb013470ad58fc2faba78eb1b19ad919b9e470348b6fdea51caf0798fe91fbe032413c2d81c98de3
SSDEEP 3072:qChA2adEHppUN/E4100rpVcZQjxmmtR1rrgRW:7b5UN/Eu00zcZ0mmPdr
TLSH
T1A4B3495972E900F9E077C339C8611A05E7B7F86247619FEF03A4426A1F63AD18D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

46676

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpConnect

advapi32

RegQueryValueExA GetUserNameA RegOpenKeyExA RegCloseKey

user32

wsprintfA wsprintfW

kernel32

SetFilePointerEx GetConsoleOutputCP FlushFileBuffers CreateFileW WriteConsoleW GetConsoleMode FreeLibrary HeapReAlloc HeapSize VirtualFree VirtualAlloc CreateToolhelp32Snapshot MultiByteToWideChar Process32NextW LoadLibraryA Process32FirstW CloseHandle GetProcAddress WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetProcessHeap RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW

Name

.text

Size

101KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

2026-03-13_640464354fe4e5679611c483f95f7c3c_cobalt-strike_icedid_satacom_vidar

winhttp

advapi32

user32

kernel32

generic