2026-07-07_0cb9ce2b913324f935723d425977b52a_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-07_0cb9ce2b913324f935723d425977b52a_cobalt-strike_icedid_njrat_satacom_vidar
Size 12.2MB
Sample260707-mz62rsgv21
SHA256 27262de15e595ada8fbaeaca2c0ac4af954245eedca9217768ae8f2ceb6a2d27
MD5 0cb9ce2b913324f935723d425977b52a
SHA1 60e3c6b39f41ae4c360d636ebb33326485bb676d
SHA512 c25ee67b097d5980a193d93427b9baa74f992cad150abdb3991641d1f47ad7a98a5360a2b4f9a8ba64806f8c137ae9de40f9d159bac682dd05c020f8dec5bbb9
SSDEEP 393216:lK4blB/MHfTJAXAHPGEAIKewnH6J6+Pmzrw1Rp9sS9x5t:0cnIfVAXkGpIfkaBuzrw1R3sSp
TLSH
T1A9D6127A72A880E8C127D039DB56AAA7F6793049073496FB00F0456E6E779F14E7F321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-07_0cb9ce2b913324f935723d425977b52a_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-07-07_0cb9ce2b913324f935723d425977b52a_cobalt-strike_icedid_njrat_satacom_vidar

.exe 12.2MB

2026-07-07_0cb9ce2b913324f935723d425977b52a_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH f2080047e1b55071cf0a9669c061ef55
SHA256 27262de15e595ada8fbaeaca2c0ac4af954245eedca9217768ae8f2ceb6a2d27
MD5 0cb9ce2b913324f935723d425977b52a
SHA1 60e3c6b39f41ae4c360d636ebb33326485bb676d
SHA512 c25ee67b097d5980a193d93427b9baa74f992cad150abdb3991641d1f47ad7a98a5360a2b4f9a8ba64806f8c137ae9de40f9d159bac682dd05c020f8dec5bbb9
SSDEEP 393216:lK4blB/MHfTJAXAHPGEAIKewnH6J6+Pmzrw1Rp9sS9x5t:0cnIfVAXkGpIfkaBuzrw1R3sSp
TLSH
T1A9D6127A72A880E8C127D039DB56AAA7F6793049073496FB00F0456E6E779F14E7F321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1793692

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\build\output\unity\unity\artifacts\tools\JobProcess\release_Win_x64_VS2022_VB_MT\JobProcess_x64.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

kernel32

LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapQueryInformation HeapSize HeapReAlloc ReadConsoleW GetCommandLineW GetCommandLineA FreeLibraryAndExitThread ExitThread TlsGetValue TlsSetValue GetLastError MultiByteToWideChar CloseHandle CreateFileW FlushFileBuffers ReadFile WriteFile WaitNamedPipeW GetCurrentProcess GetCurrentProcessId GlobalMemoryStatusEx GetModuleHandleW GetProcAddress WideCharToMultiByte GetSystemInfo GetLogicalProcessorInformationEx LocalFree FormatMessageW CreateThread HeapAlloc HeapFree GetProcessHeap WaitForSingleObject SwitchToThread GetCurrentThread GetCurrentThreadId SetThreadPriority GetThreadPriority ResumeThread SetThreadDescription SleepEx WaitForSingleObjectEx SetWaitableTimer CreateWaitableTimerExW GetModuleFileNameW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFullPathNameW GetTempFileNameW RemoveDirectoryW SetEndOfFile GetLocaleInfoW SetFilePointer SetFilePointerEx SetFileTime GetSystemTime CopyFileW MoveFileExW ReplaceFileW SystemTimeToFileTime OpenProcess SetUnhandledExceptionFilter SetErrorMode DeleteCriticalSection IsDebuggerPresent QueryPerformanceCounter QueryPerformanceFrequency SetEvent ReleaseSemaphore CreateEventW TlsAlloc TlsFree FreeLibrary EnterCriticalSection LeaveCriticalSection ReleaseMutex CreateMutexW InitializeCriticalSectionAndSpinCount GetStdHandle ResetEvent SetThreadAffinityMask WaitForMultipleObjects LoadLibraryA GetVersionExW SetThreadIdealProcessor InitializeCriticalSection RtlUnwind CreateSemaphoreA GetModuleHandleA GetProcessAffinityMask GetModuleHandleExA CreateEventA GetConsoleMode GetConsoleOutputCP GetFileType GetModuleHandleExW ExitProcess LoadLibraryExW SetLastError InterlockedPushEntrySList RtlUnwindEx IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW LCMapStringEx GetCPInfo SetFileAttributesW GetModuleFileNameA DecodePointer EncodePointer InitializeCriticalSectionEx RaiseException RtlPcToFileHeader ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW GetSystemTimeAsFileTime GetStringTypeW

shell32

SHGetKnownFolderPath SHFileOperationW

shlwapi

PathCanonicalizeW

ole32

CoCreateGuid CoTaskMemFree

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9.5MB

Virtual Size

9.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

38KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=32, id=259, version=28900,

count=209, id=261, version=28900,

count=37, id=260, version=28900,

count=10, id=253, version=34321,

count=14, id=259, version=34321,

count=18, id=260, version=34321,

count=98, id=261, version=34321,

count=1, id=262, version=28900,

count=2, id=259, productName=VS2015 [14.0] build 23026, version=23026,

count=187, id=260, productName=VS2015 [14.0] build 23026, version=23026,

count=60, id=261, productName=VS2015 [14.0] build 23026, version=23026,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=309, id=1, productName=Unmarked objects,

count=19, id=257, version=28900,

count=3, id=260, version=34433,

count=63, id=261, version=34433,

count=1, id=255, version=34433,

count=1, id=258, version=34433,