2026-05-11_ec92a7ebe7397339c1c5b16bbecf461e_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-05-11_ec92a7ebe7397339c1c5b16bbecf461e_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.5MB
Sample260511-zy9sgset2p
SHA256 f333b430a042e612355c43a0bd7675f05875f772831084e2b4d714fe92cf51d4
MD5 ec92a7ebe7397339c1c5b16bbecf461e
SHA1 c52ef2b3be2286882f6bdbe372d656fbea4d9e07
SHA512 32cf4831d8469ffa27b715b377e269b4ae429284e1e333a3361b53b1b61a10ac285887109ab03f50753d02264390159e031344408d400228e32c3bf877a630c4
SSDEEP 12288:0qpbngicziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:vpqsyy4n8c6ZsnquyncNXgeeW
TLSH
T131751297338435FAE1B68339C5910609E7323C3517A5CB5F06A0677A6F376A0AE7AF01
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-11_ec92a7ebe7397339c1c5b16bbecf461e_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-05-11_ec92a7ebe7397339c1c5b16bbecf461e_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.5MB

2026-05-11_ec92a7ebe7397339c1c5b16bbecf461e_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH edaf8dac0fc55746af6353fbce70032b
SHA256 f333b430a042e612355c43a0bd7675f05875f772831084e2b4d714fe92cf51d4
MD5 ec92a7ebe7397339c1c5b16bbecf461e
SHA1 c52ef2b3be2286882f6bdbe372d656fbea4d9e07
SHA512 32cf4831d8469ffa27b715b377e269b4ae429284e1e333a3361b53b1b61a10ac285887109ab03f50753d02264390159e031344408d400228e32c3bf877a630c4
SSDEEP 12288:0qpbngicziX6jyudnsLcGdXpFOnq/WhAnbqxNN7rgVgUPTm1Jt:vpqsyy4n8c6ZsnquyncNXgeeW
TLSH
T131751297338435FAE1B68339C5910609E7323C3517A5CB5F06A0677A6F376A0AE7AF01
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

24764

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW

msi

ord88 ord70 ord205 ord137 ord238 ord45 ord111 ord173 ord141 ord90 ord190 ord169

kernel32

CloseHandle GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetCurrentProcessId GetCurrentThreadId GetLocalTime GetModuleFileNameW lstrlenA GetComputerNameW ExpandEnvironmentStringsW CreateDirectoryW GetFullPathNameW GetTempPathW Sleep MultiByteToWideChar WideCharToMultiByte LCMapStringW GetSystemDirectoryW LoadLibraryW FindClose SetFilePointerEx GlobalAlloc GlobalFree HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap FindNextFileW GetFileAttributesW GetSystemTime SystemTimeToTzSpecificLocalTime GetTimeZoneInformation WriteConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers SetFilePointer CreateFileW GetProcAddress FreeLibrary CompareStringW lstrlenW GetModuleHandleW WriteFile GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetFileType GetCommandLineW GetCommandLineA GetModuleHandleExW ExitProcess QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException GetStdHandle

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.4MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-11_ec92a7ebe7397339c1c5b16bbecf461e_cobalt-strike_icedid_njrat_satacom_vidar

advapi32

msi

kernel32

version

generic