2026-07-01_a573cca70a30bae3de75b95061743370_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-01_a573cca70a30bae3de75b95061743370_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 568KB
Sample260701-xeef5aet6w
SHA256 3a413535e76d0b6e3e9614280216d03c020ec8438ff310e19efa213c5d0241bc
MD5 a573cca70a30bae3de75b95061743370
SHA1 a72143fb6ba5931f327a4dba4adab0b1526442e4
SHA512 17d51164bb8478b9c496b89c6892e3ccbfbf335a4d82fcddf0e587eae94e521ba680a46f1640a74160b74f1dfcadd44bfff0121fa931ed01dacc1f05ee09ab11
SSDEEP 12288:g7ZftfQqeBSOe8PtR/oEyyb50K/ofjf/3+rt:YVtffeBQ8nyyNVGm
TLSH
T1C2C48C9AB35404FDC1BBC17889574A42E272B8090760EBEF13A4D6762F236E15E3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-01_a573cca70a30bae3de75b95061743370_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-07-01_a573cca70a30bae3de75b95061743370_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 568KB

2026-07-01_a573cca70a30bae3de75b95061743370_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH b67bc82b7d3a74891d373a157b29acba
SHA256 3a413535e76d0b6e3e9614280216d03c020ec8438ff310e19efa213c5d0241bc
MD5 a573cca70a30bae3de75b95061743370
SHA1 a72143fb6ba5931f327a4dba4adab0b1526442e4
SHA512 17d51164bb8478b9c496b89c6892e3ccbfbf335a4d82fcddf0e587eae94e521ba680a46f1640a74160b74f1dfcadd44bfff0121fa931ed01dacc1f05ee09ab11
SSDEEP 12288:g7ZftfQqeBSOe8PtR/oEyyb50K/ofjf/3+rt:YVtffeBQ8nyyNVGm
TLSH
T1C2C48C9AB35404FDC1BBC17889574A42E272B8090760EBEF13A4D6762F236E15E3FB51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

499712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

shlwapi

PathCanonicalizeW

shell32

SHFileOperationW SHGetKnownFolderPath

ole32

CoTaskMemFree

kernel32

SystemTimeToFileTime WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage SetStdHandle HeapQueryInformation HeapSize HeapReAlloc ReadConsoleW GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineW GetCommandLineA GetStdHandle GetConsoleMode GetConsoleOutputCP SetConsoleCtrlHandler GetModuleHandleExW ExitProcess TerminateProcess GetCurrentProcess LoadLibraryExW InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx GetStringTypeW WideCharToMultiByte GetCurrentDirectoryW OutputDebugStringW MultiByteToWideChar CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap SleepEx WaitForSingleObjectEx SetWaitableTimer CreateWaitableTimerExW SwitchToThread GetCurrentThreadId GetModuleHandleW LocalFree FormatMessageW TlsGetValue TlsSetValue GetModuleFileNameW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW FlushFileBuffers GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFullPathNameW GetTempFileNameW ReadFile RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime WriteFile GetSystemTime CopyFileW MoveFileExW ReplaceFileW RtlUnwind IsDebuggerPresent QueryPerformanceCounter QueryPerformanceFrequency TlsAlloc TlsFree FreeLibrary GetProcAddress ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo

Name

.text

Size

324KB

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd003

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-01_a573cca70a30bae3de75b95061743370_cobalt-strike_icedid_njrat_satacom_stealc_vidar

api-ms-win-core-synch-l1-2-0

shlwapi

shell32

ole32

kernel32

generic