2026-07-10_a5876c5ccdec772e83418e73e4d5ece6_cobalt-strike_icedid_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_a5876c5ccdec772e83418e73e4d5ece6_cobalt-strike_icedid_satacom_vidar
Size 129.6MB
Sample260710-pydd6scz5x
SHA256 83c5cde437d7c40fb757f028def03f68cf94834b1068a7771029ec097a8d6320
MD5 a5876c5ccdec772e83418e73e4d5ece6
SHA1 1bc1611e73ba78b68066758112983742c7b73af6
SHA512 8a96457750dddbf878d3e615a88c6939c181999608a4f4a411485594017dde5ae3591d799251f7842d43967dc09b2f4df4eae89ee445326d813ab15d8b8cfdc3
SSDEEP 3145728:NWylWB2Nio+zpPlwFUJDyv2Iwz4PipldSermGgSYZALjR:NN+1SFUJ4NP0rP9gSYZUjR
TLSH
T1EE583304F3526EFAE1729336F8171526B930292A43D487CB4BB0A866D5337C0F576E9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_a5876c5ccdec772e83418e73e4d5ece6_cobalt-strike_icedid_satacom_vidar

File Explorer

2026-07-10_a5876c5ccdec772e83418e73e4d5ece6_cobalt-strike_icedid_satacom_vidar

.exe 129.6MB

2026-07-10_a5876c5ccdec772e83418e73e4d5ece6_cobalt-strike_icedid_satacom_vidar

IMPHASH d354d686580d943da073affa9547915a
SHA256 83c5cde437d7c40fb757f028def03f68cf94834b1068a7771029ec097a8d6320
MD5 a5876c5ccdec772e83418e73e4d5ece6
SHA1 1bc1611e73ba78b68066758112983742c7b73af6
SHA512 8a96457750dddbf878d3e615a88c6939c181999608a4f4a411485594017dde5ae3591d799251f7842d43967dc09b2f4df4eae89ee445326d813ab15d8b8cfdc3
SSDEEP 3145728:NWylWB2Nio+zpPlwFUJDyv2Iwz4PipldSermGgSYZALjR:NN+1SFUJ4NP0rP9gSYZUjR
TLSH
T1EE583304F3526EFAE1729336F8171526B930292A43D487CB4BB0A866D5337C0F576E9B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

143184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\T\M\BuildResults\bin\Release_x64\WebInstaller\AcroMiniServicesUpdater.pdb

kernel32

CloseHandle GetCurrentProcess CreateFileW ReadFile SetFilePointer WriteFile GetLastError DecodePointer SetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection FindResourceExW GetModuleFileNameW GetModuleHandleExW LoadResource LockResource SizeofResource FindResourceW MultiByteToWideChar WideCharToMultiByte GetFullPathNameW WaitForSingleObject GetCurrentProcessId ProcessIdToSessionId OpenProcess GetWindowsDirectoryW GetModuleHandleW GetProcAddress lstrcpyW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCommandLineW SetCurrentDirectoryW DeleteFileW RemoveDirectoryW GetSystemWindowsDirectoryW FindResourceA SetDllDirectoryW CreateDirectoryW FindClose FindFirstFileW FindNextFileW GetFileAttributesW SetFileAttributesW SetFileTime WriteConsoleW SetEndOfFile SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW SetFilePointerEx RtlUnwind RaiseException GetSystemInfo VirtualProtect VirtualQuery FreeLibrary LoadLibraryExA EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetStringTypeW GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW RtlPcToFileHeader RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDriveTypeW SetEnvironmentVariableW GetCurrentDirectoryW ExitProcess GetStdHandle LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx

user32

RegisterWindowMessageW PostMessageW

shell32

CommandLineToArgvW

shlwapi

PathCombineW PathFileExistsW

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

Name

.text

Size

259KB

Virtual Size

259KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

128.6MB

Virtual Size

128.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_a5876c5ccdec772e83418e73e4d5ece6_cobalt-strike_icedid_satacom_vidar

kernel32

user32

shell32

shlwapi

wtsapi32

generic