2026-07-23_e4733268dda0d2207d4534d76fa1b4c0_cobalt-strike_icedid_satacom_vidar

General

Target
2026-07-23_e4733268dda0d2207d4534d76fa1b4c0_cobalt-strike_icedid_satacom_vidar
Size 1.3MB
Sample260723-yeg3paware
SHA256 92b99b5db3bee1dc705c44ef0c9aba74d0b739f6e2ac9ed46ed0822fae45334e
MD5 e4733268dda0d2207d4534d76fa1b4c0
SHA1 3f223462487a8f49b7ee806ca7d069b11eddde30
SHA512 5a690e26e7386996620be8ac41e1858987d03e520f727b8fadfa461e30d874eddaf0f4d87b9721ae70cca560962157131301648ea0c4269bc7423a867e24c636
SSDEEP 12288:TiOKopLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:mM2NyBo4kx929bL3Hnx
TLSH
T15B551203679831F9F67A5A3488554808CB31FC7A0B61CB9F8B6145B61F7B7E14E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-23_e4733268dda0d2207d4534d76fa1b4c0_cobalt-strike_icedid_satacom_vidar

File Explorer

2026-07-23_e4733268dda0d2207d4534d76fa1b4c0_cobalt-strike_icedid_satacom_vidar

.exe 1.3MB

2026-07-23_e4733268dda0d2207d4534d76fa1b4c0_cobalt-strike_icedid_satacom_vidar

IMPHASH 628a126117baaea97bc0c0e8afade5fd
SHA256 92b99b5db3bee1dc705c44ef0c9aba74d0b739f6e2ac9ed46ed0822fae45334e
MD5 e4733268dda0d2207d4534d76fa1b4c0
SHA1 3f223462487a8f49b7ee806ca7d069b11eddde30
SHA512 5a690e26e7386996620be8ac41e1858987d03e520f727b8fadfa461e30d874eddaf0f4d87b9721ae70cca560962157131301648ea0c4269bc7423a867e24c636
SSDEEP 12288:TiOKopLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:mM2NyBo4kx929bL3Hnx
TLSH
T15B551203679831F9F67A5A3488554808CB31FC7A0B61CB9F8B6145B61F7B7E14E3AB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6564

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\obs2\build64\plugins\win-capture\inject-helper\RelWithDebInfo\inject-helper64.pdb

kernel32

Sleep GetExitCodeThread GetModuleHandleW GetProcAddress LoadLibraryW GetCommandLineW SetErrorMode WaitForSingleObject GetModuleFileNameW LocalFree WriteConsoleW CreateFileW SetFilePointerEx SetLastError GetLastError GetCurrentProcess CloseHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RaiseException GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode

user32

PostThreadMessageW

shell32

CommandLineToArgvW

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

Name

.text

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-23_e4733268dda0d2207d4534d76fa1b4c0_cobalt-strike_icedid_satacom_vidar

kernel32

user32

shell32

advapi32

generic