2026-07-07_65ab7eb89820478896f7c23eaab011af_cobalt-strike_icedid_njrat_ryuk_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-07_65ab7eb89820478896f7c23eaab011af_cobalt-strike_icedid_njrat_ryuk_satacom_vidar
Size 4.4MB
Sample260707-jtkpssat2m
SHA256 45100872884c11d18bf246274335fa86421a5816ef06797de949390ef2459194
MD5 65ab7eb89820478896f7c23eaab011af
SHA1 5c20183611949665328e955b15541a90727feb19
SHA512 07c3ddec911127b5d8f408abc39fcf227d613820203de4f824d2b555b1f8bfc7d99ce5571950e4a0f7d6cb243abca567d8ed4cafaf886435ce369afa321c042c
SSDEEP 49152:Brsk8ssmuHJME0wswdp84Me9xE5UitjwdYylvhgq4HAWwzNWqwgy+A5seTaInFUz:Qsym4tgiiUYylQHAWwqT+A5seThNe1
TLSH
T11B265CA2F36140B5D44EC874DE6D956187283C4E47F193FF26D87AF52A72AC83B29B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-07_65ab7eb89820478896f7c23eaab011af_cobalt-strike_icedid_njrat_ryuk_satacom_vidar

File Explorer

2026-07-07_65ab7eb89820478896f7c23eaab011af_cobalt-strike_icedid_njrat_ryuk_satacom_vidar

.exe 4.4MB

2026-07-07_65ab7eb89820478896f7c23eaab011af_cobalt-strike_icedid_njrat_ryuk_satacom_vidar

IMPHASH e26c0ec295f840f282fb4cbb76ee0035
SHA256 45100872884c11d18bf246274335fa86421a5816ef06797de949390ef2459194
MD5 65ab7eb89820478896f7c23eaab011af
SHA1 5c20183611949665328e955b15541a90727feb19
SHA512 07c3ddec911127b5d8f408abc39fcf227d613820203de4f824d2b555b1f8bfc7d99ce5571950e4a0f7d6cb243abca567d8ed4cafaf886435ce369afa321c042c
SSDEEP 49152:Brsk8ssmuHJME0wswdp84Me9xE5UitjwdYylvhgq4HAWwzNWqwgy+A5seTaInFUz:Qsym4tgiiUYylQHAWwqT+A5seThNe1
TLSH
T11B265CA2F36140B5D44EC874DE6D956187283C4E47F193FF26D87AF52A72AC83B29B10
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Windows executables referencing non-Windows User-Agents
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2286752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

lark.exe.pdb

advapi32

AccessCheck AddMandatoryAce AdjustTokenPrivileges BuildTrusteeWithSidW ConvertSidToStringSidW ConvertStringSidToSidW CreateProcessAsUserW CreateRestrictedToken DuplicateTokenEx EqualSid FreeSid GetAce GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSecurityInfo GetTokenInformation GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle ImpersonateLoggedOnUser InitializeAcl InitializeSecurityDescriptor IsValidAcl IsValidSecurityDescriptor IsValidSid LookupPrivilegeValueW MapGenericMask OpenProcessToken OpenThreadToken RegCloseKey RegCreateKeyExW RegDeleteValueW RegDisablePredefinedCache RegOpenKeyExW RegQueryValueExW RegSetValueExW RegisterTraceGuidsW RevertToSelf SetEntriesInAclW SetNamedSecurityInfoW SetSecurityDescriptorDacl SetSecurityInfo SetThreadToken SetTokenInformation SystemFunction036 TraceEvent UnregisterTraceGuids

shell32

CommandLineToArgvW ord680 SHGetFolderPathW SHGetKnownFolderPath ShellExecuteW

shlwapi

PathMatchSpecW SHGetValueW

user32

CloseDesktop CloseWindowStation CreateDesktopW CreateWindowExW CreateWindowStationW DefWindowProcW DialogBoxParamW DispatchMessageW EndDialog GetMessageW GetProcessWindowStation GetSystemMetrics GetThreadDesktop GetUserObjectInformationW GetWindowLongPtrW GetWindowRect MessageBoxW MoveWindow PostMessageW PostQuitMessage RegisterClassW SetProcessDPIAware SetProcessWindowStation SetWindowLongPtrW TranslateMessage

ws2_32

WSAGetLastError WSAStartup gethostname

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CompareStringW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateJobObjectW CreateMutexW CreateRemoteThread CreateThread DebugBreak DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesEx EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHandleCount GetProcessHeap GetProcessHeaps GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemFirmwareTable GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadId GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultLocaleName GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx HeapDestroy HeapSetInformation InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleInformation K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockResource MapViewOfFile MultiByteToWideChar OpenProcess PostQueuedCompletionStatus QueryInformationJobObject QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive RemoveDirectoryW ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointerEx SetHandleInformation SetInformationJobObject SetLastError SetProcessShutdownParameters SetStdHandle SetThreadAffinityMask SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SwitchToThread SystemTimeToTzSpecificLocalTime TerminateJobObject TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualAllocEx VirtualFree VirtualFreeEx VirtualProtect VirtualProtectEx VirtualQuery WaitForMultipleObjects WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory lstrlenA

ole32

CoCreateGuid CoInitialize CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoTaskMemFree CoUninitialize

iphlpapi

GetAdaptersInfo

winmm

timeBeginPeriod timeEndPeriod timeGetTime

version

VerQueryValueW

ntdll

RtlInitUnicodeString

wininet

HttpAddRequestHeadersA HttpEndRequestA HttpOpenRequestA HttpQueryInfoA HttpSendRequestA HttpSendRequestExA InternetCloseHandle InternetConnectA InternetCrackUrlA InternetOpenA InternetQueryDataAvailable InternetReadFile InternetSetOptionA InternetWriteFile

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

553KB

Virtual Size

552KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

58KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

196B

Characteristics

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

489B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

475KB

Virtual Size

474KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-07_65ab7eb89820478896f7c23eaab011af_cobalt-strike_icedid_njrat_ryuk_satacom_vidar

advapi32

shell32

shlwapi

user32

ws2_32

kernel32

ole32

iphlpapi

winmm

version

ntdll

wininet

generic