2026-07-22_27dce9c51a4200fd72ae713ce5cb7c92_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_27dce9c51a4200fd72ae713ce5cb7c92_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 1.3MB
Sample260723-aj54baeb84
SHA256 32aebd5c39294a666f6ce0a948a4abe3c1411368cc3d8a8190875cce3cf45136
MD5 27dce9c51a4200fd72ae713ce5cb7c92
SHA1 352d0347f2f81764f113f39a12ae27e2491bca47
SHA512 f3036c514384f463c0dbb2bbfe32e703dbc435dbed17d951073f5e07cdd5236146fbc63e15db22eed08e387dee42eb634deaddefe03177a0f5693cbe0f5eed10
SSDEEP 24576:pQwFAZxP+8GRb8PSHvfru0psqjnhMgeiCl7G0nehbGZpbD:pQwyD+8GaCrbDmg27RnWGj
TLSH
T19955D045629C03E5D4BA8436C5428679E171FC2647A28BDB82B47B6F1F3B5E04F3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_27dce9c51a4200fd72ae713ce5cb7c92_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-07-22_27dce9c51a4200fd72ae713ce5cb7c92_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 1.3MB

2026-07-22_27dce9c51a4200fd72ae713ce5cb7c92_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH 8cb570dc22659b56093d73e519faeef4
SHA256 32aebd5c39294a666f6ce0a948a4abe3c1411368cc3d8a8190875cce3cf45136
MD5 27dce9c51a4200fd72ae713ce5cb7c92
SHA1 352d0347f2f81764f113f39a12ae27e2491bca47
SHA512 f3036c514384f463c0dbb2bbfe32e703dbc435dbed17d951073f5e07cdd5236146fbc63e15db22eed08e387dee42eb634deaddefe03177a0f5693cbe0f5eed10
SSDEEP 24576:pQwFAZxP+8GRb8PSHvfru0psqjnhMgeiCl7G0nehbGZpbD:pQwyD+8GaCrbDmg27RnWGj
TLSH
T19955D045629C03E5D4BA8436C5428679E171FC2647A28BDB82B47B6F1F3B5E04F3DB22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

170816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qb\workspace\21461\source\output\dump64\gfxui\EventManager\igfxEM\Release\igfxEM.pdb

kernel32

GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalUnlock GlobalLock GlobalHandle GlobalFree MulDiv lstrcmpW lstrcmpiW MultiByteToWideChar WideCharToMultiByte DeleteFileW FindClose FindFirstFileW FindNextFileW GetExitCodeThread GetTickCount ExpandEnvironmentStringsW SetFileAttributesW GetSystemDirectoryW CreateDirectoryW OpenEventW GetCurrentProcessId ProcessIdToSessionId GetFileAttributesW CreateProcessW LoadLibraryW WTSGetActiveConsoleSessionId GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetSystemDefaultLangID WriteConsoleW SetEndOfFile CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindFirstFileExW FlushFileBuffers GetOEMCP GetACP IsValidCodePage GetFileSizeEx FindResourceExW SetFilePointerEx ReadConsoleW GetConsoleMode GetTimeZoneInformation GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetModuleHandleExW ExitProcess WriteFile GetStdHandle ReadFile VirtualQuery VirtualProtect GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc RtlPcToFileHeader RtlUnwindEx GetCPInfo LCMapStringEx GetStringTypeW LocalFree GetStartupInfoW GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent GetCurrentThreadId CreateThread Sleep CreateEventW CreateMutexW WaitForSingleObject SetEvent LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc FreeLibrary HeapDestroy SetLastError DecodePointer CloseHandle GetCommandLineW DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException GetConsoleOutputCP RtlUnwind

user32

IsWindow CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW DefWindowProcW PostThreadMessageW SendMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW UnregisterClassW KillTimer GetSystemMetrics GetSubMenu IsChild TrackPopupMenuEx SetMenuDefaultItem SetForegroundWindow GetWindowRect SetWindowContextHelpId MessageBoxW CreateDialogIndirectParamW GetDlgItem CharUpperW GetCursorPos LoadIconW LoadImageW MapDialogRect GetDisplayConfigBufferSizes SetDisplayConfig QueryDisplayConfig SetWindowPos MoveWindow InsertMenuW DestroyWindow CharNextW SetFocus GetFocus SetCapture ReleaseCapture CreateAcceleratorTableW DestroyAcceleratorTable GetDC ReleaseDC BeginPaint EndPaint InvalidateRect ClientToScreen InvalidateRgn RedrawWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW SetTimer MapVirtualKeyExW GetKeyNameTextW SendDlgItemMessageW EndDialog CreateDialogParamW IsWindowVisible ShowWindow PostQuitMessage UnregisterDeviceNotification RegisterDeviceNotificationW UnregisterHotKey RegisterHotKey GetKeyboardLayout GetKeyboardLayoutList ActivateKeyboardLayout LoadKeyboardLayoutW MsgWaitForMultipleObjects PeekMessageW FindWindowW DestroyMenu CreatePopupMenu PostMessageW LoadCursorW GetWindow GetClassNameW GetParent GetDesktopWindow SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW GetWindowLongW FillRect GetSysColor ScreenToClient GetClientRect

gdi32

GetObjectW SelectObject BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush DeleteDC DeleteObject GetStockObject GetDeviceCaps

advapi32

RegDeleteKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumKeyExW

ole32

CLSIDFromString OleLockRunning OleRun OleUninitialize OleInitialize CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CLSIDFromProgID CoInitializeEx CoCreateInstance CoReleaseServerProcess CoAddRefServerProcess CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoGetClassObject CoUninitialize CreateStreamOnHGlobal

oleaut32

SysAllocStringLen SysStringLen VariantInit VariantClear VarUI4FromStr SysAllocString LoadRegTypeLi RegisterTypeLi UnRegisterTypeLi OleCreateFontIndirect SysStringByteLen SysAllocStringByteLen LoadTypeLi GetErrorInfo SysFreeString

setupapi

SetupDiCreateDeviceInfoList SetupDiGetClassDevsW SetupDiGetDevicePropertyW SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiOpenDeviceInfoW SetupDiOpenDevRegKey

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

shell32

Shell_NotifyIconW SHCreateItemFromParsingName

shlwapi

StrStrW

bcrypt

BCryptHashData BCryptCreateHash BCryptFinishHash BCryptDestroyHash BCryptDecrypt BCryptEncrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider BCryptDestroyKey

version

GetFileVersionInfoExW VerQueryValueW GetFileVersionInfoSizeExW

Name

.text

Size

391KB

Virtual Size

390KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

137KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

148KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_27dce9c51a4200fd72ae713ce5cb7c92_cobalt-strike_icedid_njrat_satacom_stealc_vidar

kernel32

user32

gdi32

advapi32

ole32

oleaut32

setupapi

wtsapi32

shell32

shlwapi

bcrypt

version

generic