2026-05-09_a9e51e0f6e11d100bc104acc8068a3c4_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-09_a9e51e0f6e11d100bc104acc8068a3c4_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 1.3MB
Sample260509-txchpsav31
SHA256 b30df6942600171585a313eb2762bf0ba371caaff9e4153c41ea8db74aa363c7
MD5 a9e51e0f6e11d100bc104acc8068a3c4
SHA1 bd260f3c5fe37cba72241965dcc03268602a1c04
SHA512 752835dcfe17ac27fc14fbae127793a7f982c8f2f2453ff4b4e4886d53800d24d7de801d487711fa9771bb92c72023a030d63641e00734fd0671f55536c4b320
SSDEEP 24576:n9C3MbqyeOojATzjaPiyJq+EpNlSpMsqjnhMgeiCl7G0nehbGZpbD:9C3NXOSsjaqUEpNXDmg27RnWGj
TLSH
T1F955C026A7E902F8E0B7E579C9968907E7B77C0603709A4F03E446A71F673609F39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-09_a9e51e0f6e11d100bc104acc8068a3c4_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-05-09_a9e51e0f6e11d100bc104acc8068a3c4_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 1.3MB

2026-05-09_a9e51e0f6e11d100bc104acc8068a3c4_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH 43abd757e2af547c27f3aa862031733e
SHA256 b30df6942600171585a313eb2762bf0ba371caaff9e4153c41ea8db74aa363c7
MD5 a9e51e0f6e11d100bc104acc8068a3c4
SHA1 bd260f3c5fe37cba72241965dcc03268602a1c04
SHA512 752835dcfe17ac27fc14fbae127793a7f982c8f2f2453ff4b4e4886d53800d24d7de801d487711fa9771bb92c72023a030d63641e00734fd0671f55536c4b320
SSDEEP 24576:n9C3MbqyeOojATzjaPiyJq+EpNlSpMsqjnhMgeiCl7G0nehbGZpbD:9C3NXOSsjaqUEpNXDmg27RnWGj
TLSH
T1F955C026A7E902F8E0B7E579C9968907E7B77C0603709A4F03E446A71F673609F39721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

497472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\WinRAR\rar\build\rar64\Release\RAR.pdb

kernel32

SetConsoleCtrlHandler GetCurrentProcess DeviceIoControl FindClose SetFileTime CloseHandle BackupRead BackupSeek RemoveDirectoryW CreateFileW DeleteFileW FindFirstFileW CreateHardLinkW GetShortPathNameW GetLongPathNameW MoveFileW ReadFile FlushFileBuffers SetEndOfFile SetFilePointer GetFileTime GetCurrentProcessId GetDriveTypeW GetDiskFreeSpaceExW CreateDirectoryW SetFileAttributesW GetFileAttributesW GetVolumeInformationW FindNextFileW GetVersionExW GetModuleFileNameW SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW FoldStringW SetErrorMode FreeLibrary LoadLibraryExW ExpandEnvironmentStringsW CompareStringA GetLocaleInfoW FormatMessageW SetThreadPriority SetThreadExecutionState CreateEventW LoadLibraryW GetSystemDirectoryW SetPriorityClass GetProcessAffinityMask CreateThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateSemaphoreW GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToLocalFileTime LocalFileTimeToFileTime FileTimeToSystemTime GetCPInfo IsDBCSLeadByte MultiByteToWideChar WideCharToMultiByte CompareStringW HeapSize SetFilePointerEx GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileA Sleep GetLastError LocalFree WriteConsoleW ReadConsoleW SetConsoleMode GetConsoleMode WriteFile GetStdHandle GetFileType GetCommandLineW GetModuleHandleW GetProcAddress GetFileInformationByHandle GetCurrentThread SetLastError FindFirstFileExA HeapReAlloc SetStdHandle GetConsoleCP LCMapStringW GetStringTypeW HeapAlloc HeapFree RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW QueryPerformanceFrequency GetModuleFileNameA GetCommandLineA GetACP

user32

ExitWindowsEx LoadStringW CharLowerW CharToOemBuffW CharToOemBuffA OemToCharBuffA OemToCharA CharToOemA CharUpperW OemToCharBuffW MessageBeep

advapi32

CheckTokenMembership FreeSid AllocateAndInitializeSid RegQueryValueExW RegOpenKeyExW RegCloseKey LookupPrivilegeValueW GetFileSecurityW SetFileSecurityW GetSecurityDescriptorLength AdjustTokenPrivileges OpenProcessToken CryptGenRandom CryptReleaseContext CryptAcquireContextW

shell32

SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation SHFileOperationW

ole32

CoCreateInstance CoSetProxyBlanket

oleaut32

VariantClear SysFreeString SysAllocString

powrprof

SetSuspendState

Name

.text

Size

571KB

Virtual Size

570KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-09_a9e51e0f6e11d100bc104acc8068a3c4_cobalt-strike_icedid_njrat_satacom_stealc_vidar

kernel32

user32

advapi32

shell32

ole32

oleaut32

powrprof

generic