2026-06-04_82f0ac9b14b698bd967e6b6c6f90a1fa_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-04_82f0ac9b14b698bd967e6b6c6f90a1fa_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.6MB
Sample260604-a4h5aags21
SHA256 e2d40b1e462df0eb952ac3270a81f533bc9c87f3238b816cc8b99dab7e791d72
MD5 82f0ac9b14b698bd967e6b6c6f90a1fa
SHA1 3b41d3ec99527c299c9fa41597fb614cbde851cc
SHA512 3557522c4476f074eb751454de3570b0ce932568e49ecaaa387f681adb97937242064d5cc28f7ee73e10f2557656de79906a34b0d2a2df5fdc88322ec6d6211f
SSDEEP 12288:Xz8f5ivqmcta3QkkU8GFLLvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoML:Xz4iSmllRnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1FD75D011E7E805E8E4BB9278CD638902FB327C8A5771DADF23A4562A1F37AD04D39711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-04_82f0ac9b14b698bd967e6b6c6f90a1fa_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-06-04_82f0ac9b14b698bd967e6b6c6f90a1fa_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.6MB

2026-06-04_82f0ac9b14b698bd967e6b6c6f90a1fa_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH c0237c7c16b6e65cc4fca0fc07400aad
SHA256 e2d40b1e462df0eb952ac3270a81f533bc9c87f3238b816cc8b99dab7e791d72
MD5 82f0ac9b14b698bd967e6b6c6f90a1fa
SHA1 3b41d3ec99527c299c9fa41597fb614cbde851cc
SHA512 3557522c4476f074eb751454de3570b0ce932568e49ecaaa387f681adb97937242064d5cc28f7ee73e10f2557656de79906a34b0d2a2df5fdc88322ec6d6211f
SSDEEP 12288:Xz8f5ivqmcta3QkkU8GFLLvGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoML:Xz4iSmllRnQ/tbw/2Mkjy6Fr7g0oi
TLSH
T1FD75D011E7E805E8E4BB9278CD638902FB327C8A5771DADF23A4562A1F37AD04D39711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

155552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\CheckPoints\TPDrv\builderSuperMan1\Install\WinNT5\SynTPEnhService\SynTPEnhService\x64\Release\SynTPEnhService.pdb

kernel32

TlsSetValue RemoveDirectoryW GetModuleFileNameW WaitForMultipleObjects GetProcessId GetSystemDirectoryW DeactivateActCtx FindFirstChangeNotificationW OpenProcess QueueUserWorkItem TlsAlloc LoadLibraryW FindNextChangeNotification GetProcAddress FreeLibrary TlsGetValue ReleaseActCtx GetExitCodeProcess ActivateActCtx CreateActCtxW IsWow64Process GetTickCount GetCurrentProcessId GetThreadId LocalFree WaitForSingleObjectEx LocalAlloc InitializeCriticalSection LeaveCriticalSection SetThreadPriority DeviceIoControl GetCurrentProcess EnterCriticalSection SetLastError GetWindowsDirectoryW FindResourceW LoadResource FindResourceExW LockResource MultiByteToWideChar SetFileAttributesW GetFileAttributesW lstrlenW FindNextFileW FindFirstFileW SizeofResource GetOverlappedResult ReleaseMutex CreateMutexW ResetEvent CreateThread SetEvent WaitForSingleObject WaitForMultipleObjectsEx FlushFileBuffers ConnectNamedPipe WaitNamedPipeW ReadFileEx CloseHandle Sleep CreateEventW DisconnectNamedPipe CreateFileW CreateNamedPipeW WriteFile ReadFile GetProcessHeap WriteConsoleW SetEndOfFile ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetFileType LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA GetStdHandle ExitProcess DeleteFileW GetFileAttributesExW LoadLibraryExW TlsFree EncodePointer DeleteCriticalSection HeapDestroy RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx HeapFree UnhandledExceptionFilter RtlVirtualUnwind FindClose TerminateProcess GetCurrentThreadId GetModuleHandleExW MoveFileExW ExpandEnvironmentStringsW QueryPerformanceCounter WideCharToMultiByte IsDebuggerPresent OutputDebugStringW InitializeCriticalSectionAndSpinCount GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry

user32

PeekMessageW wsprintfW RegisterPowerSettingNotification PostMessageW DestroyWindow

advapi32

GetTokenInformation GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW RegEnumKeyW RegDeleteValueW RegCreateKeyW RegCreateKeyExW CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW DeleteService ControlService ChangeServiceConfigW OpenServiceW DeregisterEventSource RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW RegisterEventSourceW ReportEventW LookupPrivilegeValueW AdjustTokenPrivileges RevertToSelf RegNotifyChangeKeyValue SetTokenInformation ImpersonateLoggedOnUser OpenProcessToken RegOpenKeyExW CreateProcessAsUserW DuplicateTokenEx LookupAccountSidW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCloseKey RegSetValueExW RegQueryValueExW

newdev

DiUninstallDevice UpdateDriverForPlugAndPlayDevicesW

setupapi

SetupCloseInfFile SetupDiDestroyDeviceInfoList CM_Get_DevNode_Status SetupDiOpenClassRegKey SetupDiClassGuidsFromNameW SetupFindNextLine SetupGetLineTextW SetupUninstallOEMInfW SetupOpenInfFileW SetupDiCallClassInstaller SetupDiSetClassInstallParamsW SetupDiGetDevicePropertyW SetupFindFirstLineW SetupDiGetINFClassW CM_Locate_DevNodeW CM_Get_Device_ID_ListW CM_Reenumerate_DevNode CM_Open_Class_KeyW CM_Get_Device_ID_List_SizeW SetupDiGetClassDevsW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInfo

shell32

ShellExecuteExW SHGetFolderPathW

ole32

CoCreateInstance CoInitialize CLSIDFromProgID StringFromGUID2

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsW WTSFreeMemory

powrprof

CallNtPowerInformation

cfgmgr32

CM_Get_DevNode_PropertyW

shlwapi

StrStrIW SHDeleteValueW SHDeleteKeyW SHCopyKeyW SHDeleteEmptyKeyW

Name

.text

Size

274KB

Virtual Size

274KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-04_82f0ac9b14b698bd967e6b6c6f90a1fa_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

user32

advapi32

newdev

setupapi

shell32

ole32

userenv

wtsapi32

powrprof

cfgmgr32

shlwapi

generic