2026-07-09_b53b204b6fe7a35c54ec0c2a04f4fa5f_cobalt-strike_icedid_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_b53b204b6fe7a35c54ec0c2a04f4fa5f_cobalt-strike_icedid_satacom_stealc_vidar
Size 1.3MB
Sample260709-ccenwsbw4p
SHA256 fc73c639399211cc105f19a91083f91316f332b5135763438ed8ff4f2d489844
MD5 b53b204b6fe7a35c54ec0c2a04f4fa5f
SHA1 2880caee0e22fec7a4a10dca0c5306bf7699f594
SHA512 1883db2e7851f00cb2e6c005598a71e0f8c64ea9542bfad7e1bbc37280b108a43d14c5ada7f575ab3cbd92bc6c5f826716fa5f70290ad5239664071ccb6af55c
SSDEEP 12288:Fcht97QABDB+h34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:FcHrVBjSnnrFb4PM4MYgLxEVyGLU
TLSH
T14D55015B33E830FDD5B68130C4A24A45E772B8725B60A75F13A4577B2F37681DC2AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_b53b204b6fe7a35c54ec0c2a04f4fa5f_cobalt-strike_icedid_satacom_stealc_vidar

File Explorer

2026-07-09_b53b204b6fe7a35c54ec0c2a04f4fa5f_cobalt-strike_icedid_satacom_stealc_vidar

.exe 1.3MB

2026-07-09_b53b204b6fe7a35c54ec0c2a04f4fa5f_cobalt-strike_icedid_satacom_stealc_vidar

IMPHASH 4f32214340f08cb2ab89522936793048
SHA256 fc73c639399211cc105f19a91083f91316f332b5135763438ed8ff4f2d489844
MD5 b53b204b6fe7a35c54ec0c2a04f4fa5f
SHA1 2880caee0e22fec7a4a10dca0c5306bf7699f594
SHA512 1883db2e7851f00cb2e6c005598a71e0f8c64ea9542bfad7e1bbc37280b108a43d14c5ada7f575ab3cbd92bc6c5f826716fa5f70290ad5239664071ccb6af55c
SSDEEP 12288:Fcht97QABDB+h34XiPvrLr0Ci41UO5wHPdjIpTEx/Mz0gLeAfsVyqBn9r2ilS:FcHrVBjSnnrFb4PM4MYgLxEVyGLU
TLSH
T14D55015B33E830FDD5B68130C4A24A45E772B8725B60A75F13A4577B2F37681DC2AB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

BraveUpdateComRegisterShell64_unsigned.pdb

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW RegQueryValueExW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError FindNextFileW GetCurrentProcess FindClose GetFileAttributesExW LoadLibraryW FreeLibrary lstrcmpiW GetTickCount LoadLibraryExW TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx RtlPcToFileHeader TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW EmptyClipboard CloseClipboard OpenClipboard SetClipboardData CharLowerBuffW

shlwapi

PathStripPathW PathRemoveExtensionW PathRemoveFileSpecW PathAppendW

shell32

CommandLineToArgvW

Name

.text

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_b53b204b6fe7a35c54ec0c2a04f4fa5f_cobalt-strike_icedid_satacom_stealc_vidar

advapi32

kernel32

user32

shlwapi

shell32

generic