2026-07-17_42fb2d5eaed864efc7f0188c55be8a90_cobalt-strike_coinminer_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-17_42fb2d5eaed864efc7f0188c55be8a90_cobalt-strike_coinminer_icedid_njrat_satacom_vidar
Size 33.5MB
Sample260718-epln3sfy6q
SHA256 77b31b12c2ccd546c9208df17518316f175b915bb0a8b6b1d398e56579947ab3
MD5 42fb2d5eaed864efc7f0188c55be8a90
SHA1 d82c1cc4c01bf53353894d015122992ca207dce7
SHA512 33c54bc73286d4378375bf52b0e0906d18935682c754e08f0ef4020c7119b32caa864741499b596c17b6cbda21dca8160b27f27da3bf9872a0a87fff6fbdb50f
SSDEEP 24576:d6Vy3PZz5+v6juTULpChb0I+kLEJm6P4d4wAfAu5:DP5nZpChbSYEJm6goD5
TLSH
T1B7773474DD77E437F5CC7A60C64BE34133D01A1927E54AA7E89A1EF400DAAAD202DA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-07-17_42fb2d5eaed864efc7f0188c55be8a90_cobalt-strike_coinminer_icedid_njrat_satacom_vidar

File Explorer

2026-07-17_42fb2d5eaed864efc7f0188c55be8a90_cobalt-strike_coinminer_icedid_njrat_satacom_vidar

.exe 33.5MB

2026-07-17_42fb2d5eaed864efc7f0188c55be8a90_cobalt-strike_coinminer_icedid_njrat_satacom_vidar

IMPHASH b832d9fe512e4c0965e3964b762b3c6a
SHA256 77b31b12c2ccd546c9208df17518316f175b915bb0a8b6b1d398e56579947ab3
MD5 42fb2d5eaed864efc7f0188c55be8a90
SHA1 d82c1cc4c01bf53353894d015122992ca207dce7
SHA512 33c54bc73286d4378375bf52b0e0906d18935682c754e08f0ef4020c7119b32caa864741499b596c17b6cbda21dca8160b27f27da3bf9872a0a87fff6fbdb50f
SSDEEP 24576:d6Vy3PZz5+v6juTULpChb0I+kLEJm6P4d4wAfAu5:DP5nZpChbSYEJm6goD5
TLSH
T1B7773474DD77E437F5CC7A60C64BE34133D01A1927E54AA7E89A1EF400DAAAD202DA1F
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d7:c6:f1:01:7f:13:49:93:8b:d0:5d:5c:50:3e:d0:4d

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

733864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

VerQueryValueA

kernel32

DecodePointer RaiseException InitializeCriticalSectionEx GetProcAddress GetModuleHandleA CreateFileW SetStdHandle GetProcessHeap FindNLSStringEx GetUserDefaultUILanguage InitAtomTable IsValidLocale SetCalendarInfoA WideCharToMultiByte OpenFileById MultiByteToWideChar LeaveCriticalSectionWhenCallbackReturns HeapSize HeapReAlloc HeapDestroy CreateNamedPipeW SetFileAttributesW GetFullPathNameA GetFileType GetDriveTypeW GetDriveTypeA GetEnvironmentStringsW WriteConsoleW DeleteCriticalSection InitializeCriticalSectionAndSpinCount SetEnvironmentVariableW FreeEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose FormatMessageA EnterCriticalSection LeaveCriticalSection LocalFree EncodePointer LCMapStringEx GetLocaleInfoEx GetStringTypeW CompareStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW GetLastError CloseHandle RtlUnwind SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW SetConsoleCtrlHandler GetTimeZoneInformation

user32

UnregisterClassA

gdi32

GetKerningPairsA MoveToEx StartDocA LineTo CreatePatternBrush CreateDCW GetStockObject

advapi32

EventAccessControl CredFree CredReadDomainCredentialsW CredReadW RegCreateKeyExA RegDisablePredefinedCacheEx RegOpenUserClassesRoot AccessCheckAndAuditAlarmA ClearEventLogA ReadEncryptedFileRaw RevertToSelf AreAnyAccessesGranted AccessCheckByType

shlwapi

SHRegGetBoolUSValueA SHRegGetPathW SHQueryInfoKeyA PathUnquoteSpacesW PathCombineW StrPBrkW PathAddExtensionA

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

154KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32.3MB

Virtual Size

32.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_42fb2d5eaed864efc7f0188c55be8a90_cobalt-strike_coinminer_icedid_njrat_satacom_vidar

PE Signature issue

version

kernel32

user32

gdi32

advapi32

shlwapi

generic