2026-05-28_7ceb9912cbbf41cf96a1058755f91785_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-28_7ceb9912cbbf41cf96a1058755f91785_cobalt-strike_icedid_njrat_satacom_vidar
Size 970KB
Sample260528-trd5caex5j
SHA256 8139a6a5289b4bd86b0b1388f15688f11108f768105f9c2f0ba5642372390ef8
MD5 7ceb9912cbbf41cf96a1058755f91785
SHA1 44ebc541c8ab65a275a073746846c437b37c235f
SHA512 08702f9569ea33a66d7f8f67405bcbfb81cef6f7faf3b8775974f3572bcda8bc3b6eac765703649adf8faf316f122ed4d531790785ce5c6d8b07f1e30da649dc
SSDEEP 24576:VQogxLOuk7e5i4VbIK+ao75goWEeivPCgCv:ulq7elVbOH3eQPC
TLSH
T15125DF12E3E805F8E1B79238CD729906E7717C5947719ADF33A06A2A1F33AD09D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_7ceb9912cbbf41cf96a1058755f91785_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-05-28_7ceb9912cbbf41cf96a1058755f91785_cobalt-strike_icedid_njrat_satacom_vidar

.exe 970KB

2026-05-28_7ceb9912cbbf41cf96a1058755f91785_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 43f54d147e74987a46be499403aca71c
SHA256 8139a6a5289b4bd86b0b1388f15688f11108f768105f9c2f0ba5642372390ef8
MD5 7ceb9912cbbf41cf96a1058755f91785
SHA1 44ebc541c8ab65a275a073746846c437b37c235f
SHA512 08702f9569ea33a66d7f8f67405bcbfb81cef6f7faf3b8775974f3572bcda8bc3b6eac765703649adf8faf316f122ed4d531790785ce5c6d8b07f1e30da649dc
SSDEEP 24576:VQogxLOuk7e5i4VbIK+ao75goWEeivPCgCv:ulq7elVbOH3eQPC
TLSH
T15125DF12E3E805F8E1B79238CD729906E7717C5947719ADF33A06A2A1F33AD09D39721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

150192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\CheckPoints\TPDrv\builderSuperMan1\Install\WinNT5\SynTPEnhService\SynTPEnhService\x64\Release\SynTPEnhService.pdb

kernel32

TlsSetValue RemoveDirectoryW GetModuleFileNameW WaitForMultipleObjects GetProcessId GetSystemDirectoryW DeactivateActCtx FindFirstChangeNotificationW OpenProcess QueueUserWorkItem TlsAlloc LoadLibraryW FindNextChangeNotification GetProcAddress FreeLibrary TlsGetValue ReleaseActCtx GetExitCodeProcess ActivateActCtx CreateActCtxW IsWow64Process GetTickCount GetCurrentProcessId GetThreadId LocalFree WaitForSingleObjectEx LocalAlloc InitializeCriticalSection LeaveCriticalSection SetThreadPriority DeviceIoControl GetCurrentProcess EnterCriticalSection SetLastError GetWindowsDirectoryW FindResourceW LoadResource FindResourceExW LockResource MultiByteToWideChar SetFileAttributesW GetFileAttributesW lstrlenW FindNextFileW FindFirstFileW SizeofResource GetOverlappedResult ReleaseMutex CreateMutexW ResetEvent CreateThread SetEvent WaitForSingleObject WaitForMultipleObjectsEx FlushFileBuffers ConnectNamedPipe WaitNamedPipeW ReadFileEx CloseHandle Sleep CreateEventW DisconnectNamedPipe CreateFileW CreateNamedPipeW WriteFile ReadFile GetProcessHeap WriteConsoleW SetEndOfFile ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetFileType LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA GetStdHandle ExitProcess DeleteFileW GetFileAttributesExW LoadLibraryExW TlsFree EncodePointer DeleteCriticalSection HeapDestroy RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx HeapFree RtlVirtualUnwind RtlLookupFunctionEntry FindClose TerminateProcess GetCurrentThreadId GetModuleHandleExW MoveFileExW ExpandEnvironmentStringsW QueryPerformanceCounter WideCharToMultiByte IsDebuggerPresent OutputDebugStringW InitializeCriticalSectionAndSpinCount GetModuleHandleW RtlCaptureContext

user32

wsprintfW PeekMessageW RegisterPowerSettingNotification PostMessageW DestroyWindow

advapi32

GetTokenInformation GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW RegEnumKeyW RegDeleteValueW RegCreateKeyW RegCreateKeyExW CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW DeleteService ControlService ChangeServiceConfigW OpenServiceW DeregisterEventSource RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW RegisterEventSourceW ReportEventW LookupPrivilegeValueW AdjustTokenPrivileges RevertToSelf RegNotifyChangeKeyValue SetTokenInformation ImpersonateLoggedOnUser OpenProcessToken RegOpenKeyExW CreateProcessAsUserW ConvertSidToStringSidW DuplicateTokenEx LookupAccountSidW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCloseKey RegSetValueExW RegQueryValueExW

newdev

DiUninstallDevice UpdateDriverForPlugAndPlayDevicesW

setupapi

SetupDiOpenClassRegKey SetupDiDestroyDeviceInfoList CM_Get_DevNode_Status SetupCloseInfFile SetupOpenInfFileW SetupUninstallOEMInfW SetupDiCallClassInstaller SetupGetLineTextW SetupFindNextLine SetupDiClassGuidsFromNameW SetupDiGetDevicePropertyW SetupFindFirstLineW CM_Uninstall_DevNode CM_Locate_DevNodeW CM_Get_Device_ID_ListW CM_Reenumerate_DevNode CM_Open_Class_KeyW CM_Get_Device_ID_List_SizeW SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo SetupDiGetINFClassW SetupDiSetClassInstallParamsW

shell32

ShellExecuteExW SHGetFolderPathW

ole32

CoInitialize CLSIDFromProgID CoCreateInstance

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

powrprof

CallNtPowerInformation

cfgmgr32

CM_Get_DevNode_PropertyW

shlwapi

StrStrIW SHDeleteValueW SHDeleteKeyW SHCopyKeyW SHDeleteEmptyKeyW

Name

.text

Size

268KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_7ceb9912cbbf41cf96a1058755f91785_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

user32

advapi32

newdev

setupapi

shell32

ole32

userenv

wtsapi32

powrprof

cfgmgr32

shlwapi

generic