2026-07-10_f3235ed51f92671cff010ce2cdde2e2b_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_f3235ed51f92671cff010ce2cdde2e2b_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 1.1MB
Sample260710-xst4qsft3j
SHA256 7b2978f95e29885c9cbf098c2534d17b3ecbe1f250a89cb5193c5db9c3c3df4f
MD5 f3235ed51f92671cff010ce2cdde2e2b
SHA1 a3e3937eb53aed802434334e7c76d5c793ebeb8a
SHA512 345bb582a479546ec094d59cb8c364ccf52273d7a9a9b625f8c28948f899eb653283d597fc0674c21f96a3b67aa9365fd5abef4b11249efd7a6ee79df028cf83
SSDEEP 24576:Tjdvk9v4quvCAuhD2vhSMXlIhF6HQMar1PcYc89inxLs3EL05q2Z/IrCFFZ:Tjdy4qLlQVarh7P9inm4uLZOkZ
TLSH
T1E545E116B3A900F8E1ABD2748D478925F773780903A09AEF03E456761F67AE45F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_f3235ed51f92671cff010ce2cdde2e2b_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-07-10_f3235ed51f92671cff010ce2cdde2e2b_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 1.1MB

2026-07-10_f3235ed51f92671cff010ce2cdde2e2b_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH 085192199382ed56cc8d1527d9ec9af8
SHA256 7b2978f95e29885c9cbf098c2534d17b3ecbe1f250a89cb5193c5db9c3c3df4f
MD5 f3235ed51f92671cff010ce2cdde2e2b
SHA1 a3e3937eb53aed802434334e7c76d5c793ebeb8a
SHA512 345bb582a479546ec094d59cb8c364ccf52273d7a9a9b625f8c28948f899eb653283d597fc0674c21f96a3b67aa9365fd5abef4b11249efd7a6ee79df028cf83
SSDEEP 24576:Tjdvk9v4quvCAuhD2vhSMXlIhF6HQMar1PcYc89inxLs3EL05q2Z/IrCFFZ:Tjdy4qLlQVarh7P9inm4uLZOkZ
TLSH
T1E545E116B3A900F8E1ABD2748D478925F773780903A09AEF03E456761F67AE45F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

175660

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\workplace\Androws\p-c9a10cf9570f40899fe60201434789b7\Build\bin\Release\env_detect.pdb

opengl32

wglDeleteContext wglMakeCurrent glGetString wglCreateContext wglGetProcAddress

wtsapi32

WTSQueryUserToken

kernel32

CloseHandle RaiseException DecodePointer GetProcAddress LocalFree DeleteCriticalSection GetModuleHandleW GetSystemTimeAsFileTime GetExitCodeProcess GetFileAttributesExW MultiByteToWideChar WideCharToMultiByte GetCurrentProcessId FreeLibrary WTSGetActiveConsoleSessionId GetFileAttributesW IsProcessorFeaturePresent GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW HeapFree GetConsoleMode GetLastError GetConsoleOutputCP FlushFileBuffers HeapAlloc GetFileType GetFileSizeEx GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc SetLastError CreateFileW WaitForSingleObject GetLocaleInfoW InitializeCriticalSectionEx GetModuleFileNameW TerminateProcess GetModuleHandleExW WriteFile GetCurrentProcess GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind GetProcessHeap SetStdHandle HeapSize WriteConsoleW RtlUnwindEx OutputDebugStringW InitializeSListHead FormatMessageA QueryPerformanceCounter QueryPerformanceFrequency InitOnceComplete InitOnceBeginInitialize CreateDirectoryW FindClose FindFirstFileExW FindNextFileW SetEndOfFile SetFilePointerEx GetTempPathW AreFileApisANSI GetFileInformationByHandleEx InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetCurrentThreadId WaitForSingleObjectEx Sleep RtlPcToFileHeader FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW GetStringTypeW ReleaseSRWLockShared AcquireSRWLockShared FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer LCMapStringEx GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW

user32

ReleaseDC DefWindowProcW DestroyWindow CreateWindowExW RegisterClassW GetDC UnregisterClassW

gdi32

ChoosePixelFormat SetPixelFormat

shell32

SHGetSpecialFolderPathW SHGetFolderPathW ShellExecuteExW

oleaut32

VariantClear

advapi32

RevertToSelf RegDisablePredefinedCache ImpersonateLoggedOnUser RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey RegCreateKeyExW

Name

.text

Size

326KB

Virtual Size

325KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

225KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_f3235ed51f92671cff010ce2cdde2e2b_cobalt-strike_icedid_njrat_satacom_stealc_vidar

opengl32

wtsapi32

kernel32

user32

gdi32

shell32

oleaut32

advapi32

generic