2026-07-06_92c1094ef8997b4c7bb12a95c76ba43c_cobalt-strike_icedid_njrat_remcos_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_92c1094ef8997b4c7bb12a95c76ba43c_cobalt-strike_icedid_njrat_remcos_satacom_vidar
Size 898KB
Sample260707-cpsfhsfz2x
SHA256 ef0bcb29a8307f0118ac9319a95d86d4f51dac5aa0f50880e5ee25fe402a2167
MD5 92c1094ef8997b4c7bb12a95c76ba43c
SHA1 0490e7d1e7cac3e082d1bf9a525b6cbfed8a9fb7
SHA512 e8eeab3e4136ea6360b18b744ecf37e0f5db489eaf08934a2d8f80b6944c586128dd06b253630ac17078fd60b2577791f5c6c33ef141f4dba4c85486c58857f1
SSDEEP 24576:f1HkI2FOMYWiXlLOIhXqlZpAplMp0TCbqmSB3EQ:5kI2FOMYW0OIhXqbCplMp0TCbq7tT
TLSH
T11015014A73A91CE9E87781388E528606E7727C510724CBDF1360676BAF776E0AD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_92c1094ef8997b4c7bb12a95c76ba43c_cobalt-strike_icedid_njrat_remcos_satacom_vidar

File Explorer

2026-07-06_92c1094ef8997b4c7bb12a95c76ba43c_cobalt-strike_icedid_njrat_remcos_satacom_vidar

.exe 898KB

2026-07-06_92c1094ef8997b4c7bb12a95c76ba43c_cobalt-strike_icedid_njrat_remcos_satacom_vidar

IMPHASH 414fa1b73bd09571e84d9fcc476f07e6
SHA256 ef0bcb29a8307f0118ac9319a95d86d4f51dac5aa0f50880e5ee25fe402a2167
MD5 92c1094ef8997b4c7bb12a95c76ba43c
SHA1 0490e7d1e7cac3e082d1bf9a525b6cbfed8a9fb7
SHA512 e8eeab3e4136ea6360b18b744ecf37e0f5db489eaf08934a2d8f80b6944c586128dd06b253630ac17078fd60b2577791f5c6c33ef141f4dba4c85486c58857f1
SSDEEP 24576:f1HkI2FOMYWiXlLOIhXqlZpAplMp0TCbqmSB3EQ:5kI2FOMYW0OIhXqbCplMp0TCbq7tT
TLSH
T11015014A73A91CE9E87781388E528606E7727C510724CBDF1360676BAF776E0AD3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

87628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

H:\pub_18tol\master_kso_v12\Build\Release_x64\WPSOffice\office6\kvprinter\kvpins64.pdb

kvpvbsext64

?RunScript@ScriptInterpreter@@YAJPEB_WPEBD0PEAPEAUtagSAFEARRAY@@PEAUtagVARIANT@@@Z

kernel32

WriteConsoleW SetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW GetTempFileNameW RemoveDirectoryW SetFileAttributesW GetTempPathW IsDebuggerPresent OutputDebugStringW CloseHandle GetLastError SetLastError FatalAppExitW HeapAlloc HeapFree GetProcessHeap SetEvent WaitForSingleObject CreateEventW SetWaitableTimer Sleep CreateWaitableTimerW GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess TerminateThread GetExitCodeThread ResumeThread CreateProcessW OpenProcess GetTickCount GetSystemDirectoryW GetNativeSystemInfo VirtualQuery GetModuleFileNameW GetModuleHandleW GetProcAddress LocalFree FormatMessageW GetPrivateProfileIntW GetPrivateProfileStringW CopyFileW MoveFileExW WideCharToMultiByte GetLocaleInfoW GetThreadLocale GetSystemDefaultLCID CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer OutputDebugStringA RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection FreeLibrary LoadLibraryExW LoadResource SizeofResource FindResourceW lstrcmpiW MultiByteToWideChar CreateFileMappingW MapViewOfFile UnmapViewOfFile IsValidCodePage CreateFileW LoadLibraryW GetCurrentThreadId GetWindowsDirectoryW IsWow64Process HeapReAlloc HeapSize DebugBreak GetSystemInfo lstrlenA SwitchToThread CreateThread VirtualProtect LoadLibraryExA QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlPcToFileHeader RtlUnwindEx EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile ExitProcess GetFileType LCMapStringW FindClose FindFirstFileExW FindNextFileW GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW SetFilePointerEx FlushFileBuffers GetConsoleCP GetConsoleMode

Name

.text

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

78KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.kvpver

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_92c1094ef8997b4c7bb12a95c76ba43c_cobalt-strike_icedid_njrat_remcos_satacom_vidar

kvpvbsext64

kernel32

generic