2026-07-08_db0e9cdceb4788e67f98fe8e90b26702_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-07-08_db0e9cdceb4788e67f98fe8e90b26702_cobalt-strike_icedid_njrat_satacom_vidar
Size 253KB
Sample260708-lppt3aez2l
SHA256 df99f4680bff09b54cf9126f0d42123e4b5bfc901591134c6f8802263ebb5ca1
MD5 db0e9cdceb4788e67f98fe8e90b26702
SHA1 11228120cc2cb9b7225eb054a33d0f54fcdc3d8c
SHA512 122fad1242d838bb24e6871378bbc6bad9adf30182ae7b04befd3d3340dd390eb28276d564b88d31d5f4c751a78ff0849d6caba714195bbf60f7405695b13c63
SSDEEP 6144:UNY0J9QPHEBIFo4l2pji6nPOdLjKSaIILigZRYM7Yj+Ggqwkwbn1JH:UN2HEQNlaO+GdLWnIIL5r3s9gnJ7H
TLSH
T12844CF9573A41CF9EE67923DC9911906EA72BC160B60DB6F03A052671F233916E3FF60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-08_db0e9cdceb4788e67f98fe8e90b26702_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-07-08_db0e9cdceb4788e67f98fe8e90b26702_cobalt-strike_icedid_njrat_satacom_vidar

.exe 253KB

2026-07-08_db0e9cdceb4788e67f98fe8e90b26702_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 15a4658af566c1cbd8047dfba5b43fee
SHA256 df99f4680bff09b54cf9126f0d42123e4b5bfc901591134c6f8802263ebb5ca1
MD5 db0e9cdceb4788e67f98fe8e90b26702
SHA1 11228120cc2cb9b7225eb054a33d0f54fcdc3d8c
SHA512 122fad1242d838bb24e6871378bbc6bad9adf30182ae7b04befd3d3340dd390eb28276d564b88d31d5f4c751a78ff0849d6caba714195bbf60f7405695b13c63
SSDEEP 6144:UNY0J9QPHEBIFo4l2pji6nPOdLjKSaIILigZRYM7Yj+Ggqwkwbn1JH:UN2HEQNlaO+GdLWnIIL5r3s9gnJ7H
TLSH
T12844CF9573A41CF9EE67923DC9911906EA72BC160B60DB6F03A052671F233916E3FF60
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

11:58:c0:fa:93:9f:1d:e3:a5:78:b2:6e:da:82:9a:f5:eb:a8:a2:8e:38:c8:3b:b9:b0:bb:ba:85:dc:09:62:11

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Oscar,OU=Tango,O=Ross,L=Katy,ST=Moss,C=AU,1.2.840.113549.1.9.1=#0c0f42656c6c7569406d6f72742e636f6d

Chains

Jul 8, 2026

CN=Oscar,OU=Tango,O=Ross,L=Katy,ST=Moss,C=AU,1.2.840.113549.1.9.1=#0c0f42656c6c7569406d6f72742e636f6d

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Oscar,OU=Tango,O=Ross,L=Katy,ST=Moss,C=AU,1.2.840.113549.1.9.1=#0c0f42656c6c7569406d6f72742e636f6d

Serial Number

25:5a:0b:0e:56:26:1f:07:7f:af:70:44:cc:2b:8c:35:1c:47:9c:bc

Issuer

CN=Oscar,OU=Tango,O=Ross,L=Katy,ST=Moss,C=AU,1.2.840.113549.1.9.1=#0c0f42656c6c7569406d6f72742e636f6d

Revocation Status

Not revoked

Timespan

Aug 27, 2025 - Aug 27, 2026

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

0

Major OS version

6

Entry point

110832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetEnvironmentVariableA DebugActiveProcessStop CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap QueueUserAPC CreateProcessA VirtualAllocEx VirtualProtectEx WriteProcessMemory FreeLibrary GetProcAddress LoadLibraryA CreateFileW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader RtlUnwind GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_db0e9cdceb4788e67f98fe8e90b26702_cobalt-strike_icedid_njrat_satacom_vidar

PE Signature issue

kernel32

generic