2026-07-22_e51e5f3f7bad17e816bc027330cf267d_cobalt-strike_icedid_njrat_satacom_stealc_vidar

General

Target
2026-07-22_e51e5f3f7bad17e816bc027330cf267d_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 445KB
Sample260722-232c1sdc49
SHA256 0070cf29d5bc05d5bb3a2abae7b7611a538a7c18a52830ecc4c70b0065a9edbf
MD5 e51e5f3f7bad17e816bc027330cf267d
SHA1 d54a1a721958bdc8f8a500f1b6e4ae770ef1b6d0
SHA512 c2e9a6b3d1f961967f7dffe4b765d373cc08f787a536dac63e7c0689dbd2b75afc11ec559eb4eee7bc24e6413367ae931290b5bc7e7dbcb177871a9a35cbe2f7
SSDEEP 6144:Yr6ed+PKzk89djQCMq0bE/IUzuNfvnJva21Ra0oY6gke5+/jWllZLua7Zc:Hed40k0djQ3bE/IUCpBHpoYjk7ib4a
TLSH
T14DA46D5663A800F9E1BBD17CC9A64A06E77578160370D7CF03A486762F277E19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_e51e5f3f7bad17e816bc027330cf267d_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-07-22_e51e5f3f7bad17e816bc027330cf267d_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 445KB

2026-07-22_e51e5f3f7bad17e816bc027330cf267d_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH 37676fbd68999bd20af2b34c7151560c
SHA256 0070cf29d5bc05d5bb3a2abae7b7611a538a7c18a52830ecc4c70b0065a9edbf
MD5 e51e5f3f7bad17e816bc027330cf267d
SHA1 d54a1a721958bdc8f8a500f1b6e4ae770ef1b6d0
SHA512 c2e9a6b3d1f961967f7dffe4b765d373cc08f787a536dac63e7c0689dbd2b75afc11ec559eb4eee7bc24e6413367ae931290b5bc7e7dbcb177871a9a35cbe2f7
SSDEEP 6144:Yr6ed+PKzk89djQCMq0bE/IUzuNfvnJva21Ra0oY6gke5+/jWllZLua7Zc:Hed40k0djQ3bE/IUCpBHpoYjk7ib4a
TLSH
T14DA46D5663A800F9E1BBD17CC9A64A06E77578160370D7CF03A486762F277E19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

125468

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCreateKeyW RegOpenKeyW RegSetKeyValueW RegDeleteTreeW RegCloseKey

kernel32

CreateFileW GetTempPathW CloseHandle DeviceIoControl GetCurrentProcess GetCurrentProcessId GetCurrentThreadId OpenProcess VirtualAlloc VirtualFree GetModuleHandleA GetModuleHandleW GetProcAddress IsBadReadPtr K32GetModuleBaseNameW K32GetProcessMemoryInfo CreateToolhelp32Snapshot Process32FirstW Process32NextW SetEndOfFile WriteConsoleW HeapSize GetProcessHeap WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW DeleteFileW GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetCommandLineW HeapAlloc HeapFree WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle RtlUnwind

ntdll

NtQuerySystemInformation RtlInitUnicodeString

Name

.text

Size

278KB

Virtual Size

277KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_e51e5f3f7bad17e816bc027330cf267d_cobalt-strike_icedid_njrat_satacom_stealc_vidar

advapi32

kernel32

ntdll

generic