2026-07-05_73a9d9bd855c1ec0e7bafb5681980d1c_cobalt-strike_coinminer_icedid_njrat_satacom_vidar

General

Target
2026-07-05_73a9d9bd855c1ec0e7bafb5681980d1c_cobalt-strike_coinminer_icedid_njrat_satacom_vidar
Size 1.1MB
Sample260705-eabwbscy4m
SHA256 783defe060c47cd6feaa7642eaa12829beba560b1ec47cae07a784e795bbd09f
MD5 73a9d9bd855c1ec0e7bafb5681980d1c
SHA1 ddd271a17671b7d84f45d66af18b265f091c6621
SHA512 3887308f03c74cb151f5bf73caa2e18ada417132bcd4069dc854cdf7eaaa550eca21c7ed064cfd2ca0346128ebaa6a1fc104adbf57d44d376d28225a8f59c4d1
SSDEEP 24576:ciMxlm0C0kLiY4HuWiXlLOIhXqlZpAplMp0TCbqmSB3EQ:cif0yiD0OIhXqbCplMp0TCbq7tT
TLSH
T15435D05666A907FCF0B7D13889479902F2B6784A43709AEF039006771F6B7D59E3BB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_73a9d9bd855c1ec0e7bafb5681980d1c_cobalt-strike_coinminer_icedid_njrat_satacom_vidar

File Explorer

2026-07-05_73a9d9bd855c1ec0e7bafb5681980d1c_cobalt-strike_coinminer_icedid_njrat_satacom_vidar

.exe 1.1MB

2026-07-05_73a9d9bd855c1ec0e7bafb5681980d1c_cobalt-strike_coinminer_icedid_njrat_satacom_vidar

IMPHASH 4c5fe753b7975af331cc482bbe18072e
SHA256 783defe060c47cd6feaa7642eaa12829beba560b1ec47cae07a784e795bbd09f
MD5 73a9d9bd855c1ec0e7bafb5681980d1c
SHA1 ddd271a17671b7d84f45d66af18b265f091c6621
SHA512 3887308f03c74cb151f5bf73caa2e18ada417132bcd4069dc854cdf7eaaa550eca21c7ed064cfd2ca0346128ebaa6a1fc104adbf57d44d376d28225a8f59c4d1
SSDEEP 24576:ciMxlm0C0kLiY4HuWiXlLOIhXqlZpAplMp0TCbqmSB3EQ:cif0yiD0OIhXqbCplMp0TCbq7tT
TLSH
T15435D05666A907FCF0B7D13889479902F2B6784A43709AEF039006771F6B7D59E3BB20
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

221520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\pub_1c3c3\rc_bugfix_master_\Build\Release_x64\WPSOffice\office6\kcrashdumper64.pdb

kernel32

GetCommandLineW CreateFileW CloseHandle GetLastError OpenProcess GetSystemDirectoryW ReadProcessMemory FreeLibrary GetProcAddress LoadLibraryW GetTempPathW GetModuleFileNameW WideCharToMultiByte DecodePointer RaiseException HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount DeleteCriticalSection OpenThread GetProcessTimes GetSystemTimeAsFileTime GetModuleHandleExW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW ReadFile RemoveDirectoryW SetFileAttributesW WriteFile EnterCriticalSection LeaveCriticalSection GetCurrentProcessId GetCurrentThreadId GetSystemInfo OpenFileMappingW MapViewOfFile UnmapViewOfFile MoveFileExW VerSetConditionMask GetModuleHandleW lstrlenW GetPrivateProfileIntW GetPrivateProfileStringW VerifyVersionInfoW MultiByteToWideChar GetEnvironmentVariableW SetEnvironmentVariableW CreateProcessW ExpandEnvironmentStringsW Sleep GetCurrentProcess GetCurrentThread ProcessIdToSessionId WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLongPathNameW WriteConsoleW VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW QueryPerformanceCounter InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection FindFirstFileExW SetEndOfFile SetFilePointerEx EncodePointer LCMapStringEx GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx CreateEventW InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess OutputDebugStringW RtlPcToFileHeader RtlUnwindEx SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle ExitProcess GetCommandLineA GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode GetFileSizeEx ReadConsoleW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle RtlUnwind

Name

.text

Size

365KB

Virtual Size

365KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

136KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_73a9d9bd855c1ec0e7bafb5681980d1c_cobalt-strike_coinminer_icedid_njrat_satacom_vidar

kernel32

generic