2026-07-16_48800e09b2904051a93e9b31e1732d6a_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-07-16_48800e09b2904051a93e9b31e1732d6a_cobalt-strike_icedid_njrat_satacom_vidar
Size 474KB
Sample260716-e41fsagv7y
SHA256 a2c17339325759cd0cace9f13dd8bd3af3fba1fbc6eb38cbf88c10ae571986a4
MD5 48800e09b2904051a93e9b31e1732d6a
SHA1 4ce27b7bd10724e8c7d0ae789f0e624798539796
SHA512 6266fa77f62cfab1350911373cb8bb3d15b1324392f0f64b3378cefb3d8d97da23e9e392a91b7543db27c04fbb8fc9b2b6845d675fe5c9c4977b9e2cf577a062
SSDEEP 6144:6BfBWJaK0XI8MEHJu1Cvjie5ISxf0GkGbEHsKG4PwohxMBIY+H8mTpwoDe:mENaImHJTrdxf0CEAroLLrH8/o6
TLSH
T1C5A48D1AE36800F8E0B7D278C9535906E676785A4371D76F13E886672F232A09E3FF51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-16_48800e09b2904051a93e9b31e1732d6a_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-07-16_48800e09b2904051a93e9b31e1732d6a_cobalt-strike_icedid_njrat_satacom_vidar

.exe 474KB

2026-07-16_48800e09b2904051a93e9b31e1732d6a_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 7ca6642dfe0a94027f2c7d9bbdeec810
SHA256 a2c17339325759cd0cace9f13dd8bd3af3fba1fbc6eb38cbf88c10ae571986a4
MD5 48800e09b2904051a93e9b31e1732d6a
SHA1 4ce27b7bd10724e8c7d0ae789f0e624798539796
SHA512 6266fa77f62cfab1350911373cb8bb3d15b1324392f0f64b3378cefb3d8d97da23e9e392a91b7543db27c04fbb8fc9b2b6845d675fe5c9c4977b9e2cf577a062
SSDEEP 6144:6BfBWJaK0XI8MEHJu1Cvjie5ISxf0GkGbEHsKG4PwohxMBIY+H8mTpwoDe:mENaImHJTrdxf0CEAroLLrH8/o6
TLSH
T1C5A48D1AE36800F8E0B7D278C9535906E676785A4371D76F13E886672F232A09E3FF51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

137516

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

jpackageapplauncherw.exe.pdb

user32

GetMessageW TranslateMessage DispatchMessageW PostMessageW CreateWindowExW AllowSetForegroundWindow MessageBoxW

shell32

CommandLineToArgvW

kernel32

SetDllDirectoryW SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc GetCurrentDirectoryW ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapAlloc HeapFree WriteFile GetStdHandle ExitProcess GetDriveTypeW GetFullPathNameW TlsFree CloseHandle GetLastError WaitForSingleObject GetExitCodeProcess ResumeThread CreateProcessW GetProcessId AssignProcessToJobObject SetEnvironmentVariableW GetCurrentThreadId LoadLibraryExW GetCurrentProcessId GetLocalTime AllocConsole AttachConsole FreeLibrary GetModuleHandleExW GetProcAddress LoadLibraryW LocalFree FormatMessageW CreateFileW FindClose FindNextFileW GetFileAttributesW SetLastError CreateThread CreateJobObjectW SetInformationJobObject GetModuleHandleW RtlUnwind GetCommandLineW GetEnvironmentVariableW GetSystemDirectoryW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead TlsSetValue RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue

Name

.text

Size

287KB

Virtual Size

286KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-16_48800e09b2904051a93e9b31e1732d6a_cobalt-strike_icedid_njrat_satacom_vidar

user32

shell32

kernel32

generic