2026-07-10_f612ed249bd85806ffa4fa51d104042e_cobalt-strike_icedid_njrat_satacom_stealc_vidar

General

Target
2026-07-10_f612ed249bd85806ffa4fa51d104042e_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 2.6MB
Sample260710-c591hadt6w
SHA256 7c49f218bd27aa705a7e88011ea3fc185baae36e97fbd6012261e1c3a1e718f2
MD5 f612ed249bd85806ffa4fa51d104042e
SHA1 c95622bc98790f1f6e95122a610cce6583b1b683
SHA512 e14618d0f64d567c596321fa2bd73ce17eef2c9d564175a482ed489c6ebb425cb11aa43448e9bb761dd46c5cd3a661cb93cc7d726d357ac39a9d77bdb742803d
SSDEEP 49152:5IRLAzUt3tuFXy0AQ4JKYr0e+CoaYNlCBDmg27RnWGj:5mwrqD527BWG
TLSH
T19EC59E56735841EAD0A7D17C9A429743E371FC4107A08BCF16E00ADA2F6BAF51EBEB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_f612ed249bd85806ffa4fa51d104042e_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-07-10_f612ed249bd85806ffa4fa51d104042e_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 2.6MB

2026-07-10_f612ed249bd85806ffa4fa51d104042e_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH a465dac7f588273f2e704025a7a15b14
SHA256 7c49f218bd27aa705a7e88011ea3fc185baae36e97fbd6012261e1c3a1e718f2
MD5 f612ed249bd85806ffa4fa51d104042e
SHA1 c95622bc98790f1f6e95122a610cce6583b1b683
SHA512 e14618d0f64d567c596321fa2bd73ce17eef2c9d564175a482ed489c6ebb425cb11aa43448e9bb761dd46c5cd3a661cb93cc7d726d357ac39a9d77bdb742803d
SSDEEP 49152:5IRLAzUt3tuFXy0AQ4JKYr0e+CoaYNlCBDmg27RnWGj:5mwrqD527BWG
TLSH
T19EC59E56735841EAD0A7D17C9A429743E371FC4107A08BCF16E00ADA2F6BAF51EBEB41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1143996

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\buildslave\steam_rel_client_hotfix_win64\build\src\external\fossilize\fossilize-replay64Release\fossilize-replay64.pdb

kernel32

FindClose FindFirstFileExW FindNextFileW GetFullPathNameW CloseHandle GetLastError GetCurrentProcessId VirtualQuery MapViewOfFile UnmapViewOfFile CreateFileMappingA GetStdHandle GetEnvironmentStrings FreeEnvironmentStringsA CreateFileA SetHandleInformation ReleaseMutex WaitForSingleObject CreateMutexA TerminateProcess GetExitCodeProcess ResumeThread CreateProcessA AssignProcessToJobObject SetInformationJobObject CreateJobObjectA CreateDirectoryA SetFileTime GetSystemTime GetModuleFileNameA GetModuleHandleA SystemTimeToFileTime FlushFileBuffers ReadFile WriteFile DuplicateHandle SetUnhandledExceptionFilter SetErrorMode GetOverlappedResult ResetEvent CreateEventA SetWaitableTimer WaitForMultipleObjects GetCurrentProcess ExitProcess FormatMessageA OpenMutexA CreateWaitableTimerA OpenFileMappingA CreateNamedPipeA LoadLibraryA GetProcAddress WriteConsoleW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx Sleep GetExitCodeThread GetNativeSystemInfo InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW WideCharToMultiByte GetSystemTimeAsFileTime GetModuleHandleW EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread CreateFileW GetFileType GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetConsoleCtrlHandler GetModuleFileNameW GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointerEx GetFileSizeEx HeapReAlloc SetStdHandle SetEndOfFile GetCurrentDirectoryW GetTimeZoneInformation DeleteFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap HeapSize RtlUnwind

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

660KB

Virtual Size

660KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

63KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

584KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_f612ed249bd85806ffa4fa51d104042e_cobalt-strike_icedid_njrat_satacom_stealc_vidar

kernel32

generic