2026-07-20_0ddaa773a4ef40810b7357b260969dd5_cobalt-strike_icedid_satacom_vidar

General

Target
2026-07-20_0ddaa773a4ef40810b7357b260969dd5_cobalt-strike_icedid_satacom_vidar
Size 812KB
Sample260720-eqft8aew8n
SHA256 2078e8ace275ba225c92bbab6c60c727db41abeb7e777e9399423895669d23d6
MD5 0ddaa773a4ef40810b7357b260969dd5
SHA1 378ba491ed85f1f622725fe8eb03619c7d40fbbc
SHA512 6fdb51e3c66d5ae191f29df18e2391ec849f0deca993af20f82d835f4cc192787df6f39cbd0c0f706764905235cb2311ed220e1c393299eed6494b2ee48ac089
SSDEEP 12288:5HcBi5onUJ+htXoRhhEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLIg:dGiwG+htXSERIk1k7c+vDqGJAAg
TLSH
T14E05F10937AD0CF9E973817CCD829546EA72BC160751DAEB07A4472B8F376D09C3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_0ddaa773a4ef40810b7357b260969dd5_cobalt-strike_icedid_satacom_vidar

File Explorer

2026-07-20_0ddaa773a4ef40810b7357b260969dd5_cobalt-strike_icedid_satacom_vidar

.exe 812KB

2026-07-20_0ddaa773a4ef40810b7357b260969dd5_cobalt-strike_icedid_satacom_vidar

IMPHASH 50fa233c24cafdef9dbaf62c01796272
SHA256 2078e8ace275ba225c92bbab6c60c727db41abeb7e777e9399423895669d23d6
MD5 0ddaa773a4ef40810b7357b260969dd5
SHA1 378ba491ed85f1f622725fe8eb03619c7d40fbbc
SHA512 6fdb51e3c66d5ae191f29df18e2391ec849f0deca993af20f82d835f4cc192787df6f39cbd0c0f706764905235cb2311ed220e1c393299eed6494b2ee48ac089
SSDEEP 12288:5HcBi5onUJ+htXoRhhEdlIIDPa7j9aaV+aXXZdceRWcDq9UzNtsHoM6jH1GYSLIg:dGiwG+htXSERIk1k7c+vDqGJAAg
TLSH
T14E05F10937AD0CF9E973817CCD829546EA72BC160751DAEB07A4472B8F376D09C3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

44992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\rel\gfclient\nvapp_11_08\PFW\NvApp\DarkModeCheck\x64\Release\DarkModeCheck.pdb

kernel32

GetModuleFileNameA SetLastError GetFullPathNameW LocalAlloc CreateFileW GetFileAttributesW GetSystemDirectoryW GetLastError CloseHandle GetProcAddress LocalFree VerSetConditionMask GetModuleHandleW FreeLibrary VerifyVersionInfoW LoadLibraryExW HeapSize WriteConsoleW HeapReAlloc SetStdHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection FormatMessageA CreateDirectoryW FindClose GetFileAttributesExW SetEndOfFile SetFileInformationByHandle SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlUnwindEx RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetACP GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode HeapFree HeapAlloc LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap RtlUnwind

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

Name

.text

Size

150KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_0ddaa773a4ef40810b7357b260969dd5_cobalt-strike_icedid_satacom_vidar

kernel32

shell32

ole32

generic