2026-07-29_ebd0d6fa7b2cf5c6dae9dec1a233828a_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_ebd0d6fa7b2cf5c6dae9dec1a233828a_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.9MB
Sample260729-3qlbpsvdpg
SHA256 8aa7a104f5d37a6ad4cdadb8bac4a407d3d61ce0e66d753c9865be5dce8786ed
MD5 ebd0d6fa7b2cf5c6dae9dec1a233828a
SHA1 a2061739445d4626fb8b76b555a641b3891a7661
SHA512 e68f6f8133eca87e1dc25155f94f893db258a933a1c5bb1d5a56cd8f5ac01d4f32036bd5395b65dc5f90ed5211df46c772f8d12fe7a7c4e78a3b68f1d55487d7
SSDEEP 49152:EAguK8OKf6L1vq/ky6lLNiXicJFFRGNzj3:lgDq6R7wRGpj3
TLSH
T12095AE5A62A801E9E0B6D07C8A52C536E2B27C5A03714ADF03E17E673F776E45E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_ebd0d6fa7b2cf5c6dae9dec1a233828a_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-07-29_ebd0d6fa7b2cf5c6dae9dec1a233828a_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.9MB

2026-07-29_ebd0d6fa7b2cf5c6dae9dec1a233828a_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 0a620cca2c20cb9aa26204fb29f40715
SHA256 8aa7a104f5d37a6ad4cdadb8bac4a407d3d61ce0e66d753c9865be5dce8786ed
MD5 ebd0d6fa7b2cf5c6dae9dec1a233828a
SHA1 a2061739445d4626fb8b76b555a641b3891a7661
SHA512 e68f6f8133eca87e1dc25155f94f893db258a933a1c5bb1d5a56cd8f5ac01d4f32036bd5395b65dc5f90ed5211df46c772f8d12fe7a7c4e78a3b68f1d55487d7
SSDEEP 49152:EAguK8OKf6L1vq/ky6lLNiXicJFFRGNzj3:lgDq6R7wRGpj3
TLSH
T12095AE5A62A801E9E0B6D07C8A52C536E2B27C5A03714ADF03E17E673F776E45E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

454596

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

InitOnceComplete InitOnceBeginInitialize AcquireSRWLockShared ReleaseSRWLockShared TryEnterCriticalSection InitializeSRWLock RtlCaptureStackBackTrace SetConsoleTextAttribute GetComputerNameA GetWindowsDirectoryA GetTempPathA GetConsoleScreenBufferInfo CreateProcessW PeekNamedPipe GetCommandLineW FreeLibrary GetProcAddress LoadLibraryExW MultiByteToWideChar WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW GetFileAttributesW GetFileAttributesExW ReadFile RemoveDirectoryW SetFileAttributesW WriteFile CloseHandle GetCurrentProcess OutputDebugStringA OutputDebugStringW GetCurrentProcessId GetLocalTime GetTickCount GetModuleFileNameW FormatMessageA DuplicateHandle TerminateProcess GetExitCodeProcess OpenProcess ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW GetCurrentThreadId GetModuleHandleW LoadLibraryW ReleaseSRWLockExclusive TlsGetValue QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThread SetThreadPriority GetThreadPriority GetSystemTimeAsFileTime QueryThreadCycleTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileInformationByHandle GetFileSizeEx SetEndOfFile SetFilePointerEx GetProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW IsDebuggerPresent CreateThread GetThreadId GetModuleHandleExW GetVersionExW GetNativeSystemInfo CreateThreadpool SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum CloseThreadpool CallbackMayRunLong CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork TlsAlloc TlsSetValue TlsFree AcquireSRWLockExclusive CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetSystemDirectoryW GetWindowsDirectoryW ProcessIdToSessionId QueryFullProcessImageNameW WTSGetActiveConsoleSessionId EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead RtlPcToFileHeader RtlUnwindEx GetFullPathNameW SetStdHandle GetFileType GetConsoleOutputCP GetConsoleMode SetConsoleCtrlHandler ExitProcess GetStdHandle WriteConsoleW HeapAlloc HeapFree GetDriveTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc GetTimeZoneInformation HeapSize IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap LocalFree UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateEventW WaitForSingleObject ResetEvent SetEvent SetLastError MoveFileExW MoveFileW CopyFileW GetTempPathW GetTempFileNameW DeleteFileW SetErrorMode DeleteCriticalSection InitializeCriticalSectionEx RaiseException DecodePointer FlushFileBuffers GetLastError CreatePipe

advapi32

CheckTokenMembership SystemFunction036 ConvertSidToStringSidW GetTokenInformation OpenProcessToken RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey AllocateAndInitializeSid RegisterServiceCtrlHandlerW SetServiceStatus StartServiceCtrlDispatcherW ConvertStringSecurityDescriptorToSecurityDescriptorW FreeSid GetUserNameW ChangeServiceConfigW ChangeServiceConfig2W CloseServiceHandle ControlService CreateServiceW DeleteService OpenSCManagerW OpenServiceW QueryServiceStatus StartServiceW DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf

user32

PeekMessageW MsgWaitForMultipleObjectsEx PostMessageW PostQuitMessage GetQueueStatus SetTimer KillTimer DefWindowProcW RegisterClassExW GetWindowLongPtrW SetWindowLongPtrW DispatchMessageW TranslateMessage MonitorFromWindow CharUpperW UnregisterClassW LoadIconW CreateWindowExW DestroyWindow SetWindowPos SetForegroundWindow AllowSetForegroundWindow GetClientRect GetWindowRect MapWindowPoints GetWindowLongW GetParent GetWindow GetMonitorInfoW

shell32

SHGetFolderPathW ShellExecuteExW SHGetKnownFolderPath CommandLineToArgvW

winmm

timeBeginPeriod timeEndPeriod timeGetTime

ole32

CoInitializeEx CoUninitialize CoTaskMemFree

crypt32

CertNameToStrW

shlwapi

PathMatchSpecW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateSessionsW

dbghelp

SymSetOptions SymCleanup SymGetLineFromAddr64 SymInitialize SymFromAddr UnDecorateSymbolName

Name

.text

Size

720KB

Virtual Size

719KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

235KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

401KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_ebd0d6fa7b2cf5c6dae9dec1a233828a_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

advapi32

user32

shell32

winmm

ole32

crypt32

shlwapi

wtsapi32

dbghelp

generic