2026-07-14_41ff8570accbe7c49c22876d5858249e_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_41ff8570accbe7c49c22876d5858249e_cobalt-strike_icedid_njrat_satacom_vidar
Size 966KB
Sample260715-bah3vsbt6t
SHA256 0cb6e4155d2aee5ec9af581f0ace95e2ddd05b4d2841e3d1230da53a72dd26dd
MD5 41ff8570accbe7c49c22876d5858249e
SHA1 854f2cef38990c0f9e6c4ebfcf987f18ff84e549
SHA512 3aa2f7f704a99d0d5f49d654cbbe00eab79ab28a00fe35a4bf12af037df636cf8a4502e4518350c7324b68de9cd8c8b2a1dd0fe206219a789e6cbe8c19ed8df6
SSDEEP 24576:FptnAOxhFDIqZu9nQ/tbw/2Mkjy6Fr7g0o1:FTnAIX6Q/lFTjN4
TLSH
T14725E056F7A414F9E1778279CD638642EA72784A0720DBDF1398476A2F373D04E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_41ff8570accbe7c49c22876d5858249e_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-07-14_41ff8570accbe7c49c22876d5858249e_cobalt-strike_icedid_njrat_satacom_vidar

.exe 966KB

2026-07-14_41ff8570accbe7c49c22876d5858249e_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH da22c22db400ae84d6233e6648eb656c
SHA256 0cb6e4155d2aee5ec9af581f0ace95e2ddd05b4d2841e3d1230da53a72dd26dd
MD5 41ff8570accbe7c49c22876d5858249e
SHA1 854f2cef38990c0f9e6c4ebfcf987f18ff84e549
SHA512 3aa2f7f704a99d0d5f49d654cbbe00eab79ab28a00fe35a4bf12af037df636cf8a4502e4518350c7324b68de9cd8c8b2a1dd0fe206219a789e6cbe8c19ed8df6
SSDEEP 24576:FptnAOxhFDIqZu9nQ/tbw/2Mkjy6Fr7g0o1:FTnAIX6Q/lFTjN4
TLSH
T14725E056F7A414F9E1778279CD638642EA72784A0720DBDF1398476A2F373D04E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Z:\out\Release\RadminVPN\x64\Rvwix_install_exe.pdb

kernel32

InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObject GetModuleHandleW QueryPerformanceCounter QueryPerformanceFrequency GetSystemTime GetSystemTimeAsFileTime LoadLibraryW GetSystemDirectoryW SetFilePointer SetEndOfFile GetFileSize FlushFileBuffers GetModuleFileNameW GetWindowsDirectoryW GetTempPathW CreateFileW CreateDirectoryW CloseHandle WriteFile LeaveCriticalSection EnterCriticalSection GetOEMCP GetACP WideCharToMultiByte MultiByteToWideChar ExpandEnvironmentStringsW lstrlenW lstrcmpW LocalFree LoadLibraryA GetProcAddress FreeLibrary GetLocalTime Sleep ReadFile GetFullPathNameW GetFileAttributesW GetCommandLineW WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA IsValidCodePage FindNextFileW FindFirstFileExW FindClose ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetFileType HeapReAlloc HeapFree HeapAlloc GetStdHandle GetModuleHandleExW ExitProcess LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind SetLastError GetLastError RtlCaptureContext SetUnhandledExceptionFilter InitializeCriticalSection ReleaseSemaphore CreateSemaphoreW GetCurrentProcess CreateThread GetCurrentThreadId GetProcessId VirtualQueryEx SetNamedPipeHandleState TransactNamedPipe WaitNamedPipeW WaitForMultipleObjects GetCurrentProcessId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlLookupFunctionEntry

advapi32

RegGetValueW UnlockServiceDatabase QueryServiceConfigW OpenServiceW OpenSCManagerW LockServiceDatabase CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey

shell32

SHGetFolderPathW CommandLineToArgvW

ole32

CoCreateInstance StringFromCLSID CoTaskMemFree CoInitializeSecurity CoUninitialize CoInitializeEx

oleaut32

VariantInit SafeArrayCreateVector SafeArrayPutElement SafeArrayGetElement SafeArrayUnlock SafeArrayLock SafeArrayDestroy SysAllocString VariantClear

wininet

HttpQueryInfoW HttpAddRequestHeadersW InternetCrackUrlW InternetOpenW InternetCloseHandle InternetConnectW InternetReadFile InternetQueryDataAvailable InternetSetOptionW HttpOpenRequestW HttpSendRequestW

setupapi

SetupDiCreateDeviceInfoW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetINFClassW SetupDiCallClassInstaller SetupDiGetDeviceRegistryPropertyW SetupDiSetDeviceRegistryPropertyW SetupDiGetDeviceInstallParamsW SetupDiSetClassInstallParamsW CM_Get_Device_ID_ExW SetupDiCreateDeviceInfoList SetupDiGetDeviceInfoListDetailW

iphlpapi

GetAdaptersAddresses

Name

.text

Size

268KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_41ff8570accbe7c49c22876d5858249e_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

advapi32

shell32

ole32

oleaut32

wininet

setupapi

iphlpapi

generic