2026-06-25_c45deb4c0231fb78118187ab5d448ba4_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-25_c45deb4c0231fb78118187ab5d448ba4_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 2.6MB
Sample260629-yp2vvaes3x
SHA256 a607e22a3be33e6b10f671cf24622e77005c5f79819e9616a40ebc0ebefd2097
MD5 c45deb4c0231fb78118187ab5d448ba4
SHA1 b2179f5ceb607d4b0651ddf58a45eff50c4f16e1
SHA512 873c1039aec4b346ada136136db35d4e9d2b2713036f5b481050baf432508a6a8e3d5498e24f3942ccba158f2dd8c23edd694e1b293d36f48d05e083b46b8adb
SSDEEP 49152:XK5usnICvleO3dX+B/i+hGymom8HZjoaU66m1nycMPlvGpc3sW4kEkxDK5IOJ:Gw7P/vp5/joRsqs9kEkxPOJ
TLSH
T199C57E1762EA03FCE1BBD2789E665942F5B2780907306ADF0690056A1F77FE04E7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-25_c45deb4c0231fb78118187ab5d448ba4_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-06-25_c45deb4c0231fb78118187ab5d448ba4_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 2.6MB

2026-06-25_c45deb4c0231fb78118187ab5d448ba4_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH 2f2559da49425eec37a930739e061f1e
SHA256 a607e22a3be33e6b10f671cf24622e77005c5f79819e9616a40ebc0ebefd2097
MD5 c45deb4c0231fb78118187ab5d448ba4
SHA1 b2179f5ceb607d4b0651ddf58a45eff50c4f16e1
SHA512 873c1039aec4b346ada136136db35d4e9d2b2713036f5b481050baf432508a6a8e3d5498e24f3942ccba158f2dd8c23edd694e1b293d36f48d05e083b46b8adb
SSDEEP 49152:XK5usnICvleO3dX+B/i+hGymom8HZjoaU66m1nycMPlvGpc3sW4kEkxDK5IOJ:Gw7P/vp5/joRsqs9kEkxPOJ
TLSH
T199C57E1762EA03FCE1BBD2789E665942F5B2780907306ADF0690056A1F77FE04E7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1321144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\DAX331\API\output\Release\x64\DAX3API.pdb

api-ms-win-core-string-l1-1-0

GetStringTypeW MultiByteToWideChar CompareStringEx WideCharToMultiByte

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter GetLastError UnhandledExceptionFilter SetLastError RaiseException

api-ms-win-core-heap-l1-1-0

HeapAlloc HeapReAlloc HeapSize HeapFree GetProcessHeap

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx OpenMutexW CreateMutexW ReleaseMutex LeaveCriticalSection WaitForSingleObject OpenEventW ReleaseSRWLockExclusive ResetEvent EnterCriticalSection CreateEventW SetEvent DeleteCriticalSection AcquireSRWLockExclusive InitializeCriticalSectionEx InitializeSRWLock InitializeCriticalSectionAndSpinCount InitializeCriticalSection TryEnterCriticalSection

api-ms-win-core-synch-l1-2-0

WakeConditionVariable Sleep SleepConditionVariableSRW

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorDacl FreeSid GetTokenInformation DuplicateTokenEx AllocateAndInitializeSid InitializeSecurityDescriptor

api-ms-win-core-heap-l2-1-0

LocalAlloc LocalFree

api-ms-win-core-localization-l1-2-0

LCMapStringEx EnumSystemLocalesW FormatMessageW GetOEMCP GetUserDefaultLCID GetCPInfo GetACP FormatMessageA LCMapStringW IsValidCodePage GetLocaleInfoW IsValidLocale

api-ms-win-ntuser-sysparams-l1-1-0

EnumDisplaySettingsW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegQueryInfoKeyW RegEnumKeyExW RegDeleteValueW RegCloseKey RegNotifyChangeKeyValue

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoUninitialize CoCreateInstance CoTaskMemFree CoIncrementMTAUsage CoTaskMemRealloc CoInitializeEx StringFromGUID2 PropVariantClear

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-eventing-provider-l1-1-0

EventRegister EventWriteString EventUnregister

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess TlsAlloc ExitThread GetCurrentProcessId TlsGetValue TlsSetValue GetExitCodeThread GetCurrentThreadId TerminateProcess GetStartupInfoW CreateProcessAsUserW OpenProcessToken TlsFree CreateThread ExitProcess

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent OpenProcess

api-ms-win-core-memory-l1-1-0

VirtualFree MapViewOfFile CreateFileMappingW OpenFileMappingW UnmapViewOfFile

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameW LoadResource LoadLibraryExW FreeLibrary GetModuleHandleExW FreeLibraryAndExitThread GetProcAddress SizeofResource GetModuleHandleW

api-ms-win-core-kernel32-legacy-l1-1-0

WTSGetActiveConsoleSessionId

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64 GetSystemTimeAsFileTime

oleaut32

LPSAFEARRAY_UserUnmarshal LPSAFEARRAY_UserMarshal LPSAFEARRAY_UserSize BSTR_UserFree64 BSTR_UserUnmarshal64 BSTR_UserMarshal64 BSTR_UserSize64 BSTR_UserFree SafeArrayUnaccessData SafeArrayGetElemsize BSTR_UserUnmarshal LPSAFEARRAY_UserSize64 SafeArrayDestroy SysAllocString SafeArrayPutElement BSTR_UserMarshal BSTR_UserSize LPSAFEARRAY_UserMarshal64 VarUI4FromStr SysAllocStringByteLen SysStringByteLen LPSAFEARRAY_UserUnmarshal64 LPSAFEARRAY_UserFree64 SafeArrayAccessData LPSAFEARRAY_UserFree SafeArrayCreate SafeArrayCopyData SafeArrayRedim SafeArrayGetUBound VarBstrCmp SafeArrayCreateVector SafeArrayUnlock SafeArrayLock SafeArrayGetLBound SysFreeString

propsys

InitPropVariantFromBuffer PropVariantToStringWithDefault PropVariantGetElementCount PropVariantGetStringElem InitPropVariantFromInt32Vector PropVariantCompareEx

api-ms-win-devices-config-l1-1-1

CM_Locate_DevNodeW CM_Get_DevNode_PropertyW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW FindResourceW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-service-management-l2-1-0

ChangeServiceConfig2W

api-ms-win-service-management-l1-1-0

CreateServiceW OpenServiceW OpenSCManagerW CloseServiceHandle DeleteService

api-ms-win-core-file-l1-1-0

FindFirstFileExW ReadFile FindClose CreateDirectoryW GetFileSizeEx FlushFileBuffers GetFileAttributesExW FindNextFileW WriteFile SetEndOfFile SetFilePointerEx SetFileInformationByHandle DeleteFileW GetShortPathNameW GetFileType CreateFileW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-file-l2-1-2

CopyFileW

rpcrt4

RpcEpRegisterW NdrServerCallAll NdrClientCall3 RpcServerInqBindings RpcMgmtStopServerListening RpcServerUseProtseqEpW RpcServerUnregisterIf RpcServerRegisterIf3 NdrServerCall2 RpcEpUnregister RpcServerListen RpcBindingVectorFree

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolWork CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks

api-ms-win-service-core-l1-1-0

SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus ControlService

advapi32

ReportEventW DeregisterEventSource RegisterEventSourceW

wtsapi32

WTSQueryUserToken

dax3dapcontrol

GetDapParam SetDapVariantParam OpenDapControl CloseDapControl

daxssid

GetSystemDeviceInstanceId GetSSID

cfgmgr32

CM_Get_Device_Interface_PropertyW CM_Get_Device_Interface_ListW CM_Open_DevNode_Key CM_Get_Device_Interface_List_SizeW

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsW

api-ms-win-core-processenvironment-l1-1-0

FreeEnvironmentStringsW SetStdHandle GetEnvironmentStringsW GetCommandLineW GetStdHandle GetCommandLineA ExpandEnvironmentStringsW

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlUnwind RtlVirtualUnwind

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList

api-ms-win-core-console-l1-1-0

GetConsoleMode WriteConsoleW GetConsoleCP ReadConsoleW

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo GetRestrictedErrorInfo

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference WindowsDeleteString WindowsDuplicateString WindowsPromoteStringBuffer WindowsPreallocateStringBuffer WindowsDeleteStringBuffer WindowsGetStringRawBuffer

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

407KB

Virtual Size

407KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=10, id=259, version=26715,

count=175, id=261, version=26715,

count=17, id=260, version=30034,

count=10, id=259, version=30034,

count=101, id=261, version=30034,

count=4, id=257, productName=VS2019 v16.10.3 build 30038, version=30038,

count=1, id=265, version=30038,

count=21, id=260, version=26715,

count=10, id=257, version=26715,

count=3, id=263, version=26715,

count=119, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=338, id=1, productName=Unmarked objects,

count=1, id=260, productName=VS2019 v16.10.3 build 30038, version=30038,

count=53, id=261, productName=VS2019 v16.10.3 build 30038, version=30038,

count=1, id=255, productName=VS2019 v16.10.3 build 30038, version=30038,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.10.3 build 30038, version=30038,