2026-07-08_886615084a24c4fe2798729e9e8e5eb8_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-07-08_886615084a24c4fe2798729e9e8e5eb8_cobalt-strike_icedid_njrat_satacom_vidar
Size 285KB
Sample260708-e2efjaay21
SHA256 009590ad8fa980a09f671ad8347aea5d1714a6425803668d20d273402aafea9c
MD5 886615084a24c4fe2798729e9e8e5eb8
SHA1 f09a8e281c020cf897347ea301c3229f3f28216d
SHA512 168388dfe5dffc83dc8c6e47224c54b0ee0d581de00da68cb5dfe7fc9c1504fc8a042486ccfcf31e326f9ac1ff90d4c558e0c17dd9f4c0ef4af1be8f919cf3b0
SSDEEP 6144:YdJ8ujseexV9liVJbJsMf4PEJohRE7DEKwKNUdA7u:Wo7UJCMf4P8og7DJwa7
TLSH
T187545B0AB7A910F5DC77C13C8992550AFAB278625330D7EB17A157572F236E0AE3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_886615084a24c4fe2798729e9e8e5eb8_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-07-08_886615084a24c4fe2798729e9e8e5eb8_cobalt-strike_icedid_njrat_satacom_vidar

.exe 285KB

2026-07-08_886615084a24c4fe2798729e9e8e5eb8_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 040f93d841b24546472a604113388517
SHA256 009590ad8fa980a09f671ad8347aea5d1714a6425803668d20d273402aafea9c
MD5 886615084a24c4fe2798729e9e8e5eb8
SHA1 f09a8e281c020cf897347ea301c3229f3f28216d
SHA512 168388dfe5dffc83dc8c6e47224c54b0ee0d581de00da68cb5dfe7fc9c1504fc8a042486ccfcf31e326f9ac1ff90d4c558e0c17dd9f4c0ef4af1be8f919cf3b0
SSDEEP 6144:YdJ8ujseexV9liVJbJsMf4PEJohRE7DEKwKNUdA7u:Wo7UJCMf4P8og7DJwa7
TLSH
T187545B0AB7A910F5DC77C13C8992550AFAB278625330D7EB17A157572F236E0AE3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

52476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\porca\source\repos\revshell\x64\Release\revshell.pdb

kernel32

CloseHandle SetHandleInformation GetLastError WaitForSingleObject Sleep CreateProcessW WriteConsoleW CreateFileW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW RtlUnwind

ws2_32

WSASocketW WSAConnect WSAGetLastError WSACleanup inet_pton shutdown setsockopt htons closesocket WSAStartup

Name

.text

Size

186KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_886615084a24c4fe2798729e9e8e5eb8_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

ws2_32

generic