2026-07-30_3784b33e2b4775ce61db8bc36d2bbd2d_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_3784b33e2b4775ce61db8bc36d2bbd2d_cobalt-strike_icedid_njrat_satacom_vidar
Size 2.8MB
Sample260730-d8l9aabc44
SHA256 73446e012d56b5bcd03bb3e38725739381d3c8c6c0569aa05572125f4e16041f
MD5 3784b33e2b4775ce61db8bc36d2bbd2d
SHA1 ee34bc3f87104283e7e9a72b5492e830ed09d406
SHA512 c83dddac63dcbb2c89bdab5d74d6ff40e68a3328e4c8e9a936a5130bb255faaa9fedf464f2a2865329432249da1455495b7f20863db47a19a8c8cbc9cf9c7163
SSDEEP 49152:28sl3WivlbK7vnLX7z30pxzBny060vnmnM4atqZdd1v+0KrbS:13idzBy0bnmnM4aqTPKrbS
TLSH
T1C9D59E5072BB84D9D272C1349512DB1AC6B1B7425233C22F70296E58EF777832E2DF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-30_3784b33e2b4775ce61db8bc36d2bbd2d_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-07-30_3784b33e2b4775ce61db8bc36d2bbd2d_cobalt-strike_icedid_njrat_satacom_vidar

.exe 2.8MB

2026-07-30_3784b33e2b4775ce61db8bc36d2bbd2d_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH dd682e8ecc3e95ceb5b484fd91c668b8
SHA256 73446e012d56b5bcd03bb3e38725739381d3c8c6c0569aa05572125f4e16041f
MD5 3784b33e2b4775ce61db8bc36d2bbd2d
SHA1 ee34bc3f87104283e7e9a72b5492e830ed09d406
SHA512 c83dddac63dcbb2c89bdab5d74d6ff40e68a3328e4c8e9a936a5130bb255faaa9fedf464f2a2865329432249da1455495b7f20863db47a19a8c8cbc9cf9c7163
SSDEEP 49152:28sl3WivlbK7vnLX7z30pxzBny060vnmnM4atqZdd1v+0KrbS:13idzBy0bnmnM4aqTPKrbS
TLSH
T1C9D59E5072BB84D9D272C1349512DB1AC6B1B7425233C22F70296E58EF777832E2DF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

19:33:3a:cd:7a:4e:07:5a:a8:51:3b:60:7e:27:0d:89:5a:f0:c7:64:a9:ca:0d:17:e8:2a:4f:57:3d:87:a6:94

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=430001093727,CN=CrystalMark Inc.,O=CrystalMark Inc.,STREET=5-31-1\, Minami 2-Jo Nishi,L=Sapporo\, Chuo-ku,ST=Hokkaido,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jul 25, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

PE Signature issue

Digest

aa:3a:00:3e:c6:d0:c4:28:b9:09:98:e9:0b:fb:42:52:ab:15:71:02

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

Chains

Jul 25, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

4d:15:6e:71:31:22:e2:b0:84:65:46:35

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 21, 2025 - May 21, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

768796

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW LoadLibraryExA WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindFirstFileExW SetFilePointerEx ReadConsoleW SystemTimeToTzSpecificLocalTime GetConsoleOutputCP LCMapStringW GetTimeFormatW GetDateFormatW EnumSystemLocalesW IsValidLocale GetOEMCP IsValidCodePage GetStringTypeW GetCPInfo ExitProcess GetStdHandle HeapQueryInformation VirtualQuery GetSystemInfo GetFileType SetStdHandle GetCommandLineA RtlPcToFileHeader RtlUnwindEx OutputDebugStringW GetFileTime GetFileSizeEx GetFileAttributesExW GetFileAttributesW FileTimeToLocalFileTime GetUserDefaultUILanguage GetSystemDefaultUILanguage GetLocaleInfoW GlobalFlags FileTimeToSystemTime LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GetThreadLocale DuplicateHandle UnlockFile SetEndOfFile LockFile GetFullPathNameW FlushFileBuffers GetCurrentProcessId lstrcmpA GetCurrentThread CreateEventW SetEvent CompareStringW GlobalFindAtomW GlobalAddAtomW GlobalDeleteAtom GetCurrentThreadId EncodePointer FormatMessageW MulDiv LocalFree GlobalFree QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW GetModuleHandleExW LeaveCriticalSection EnterCriticalSection SetLastError OutputDebugStringA GetACP VirtualFree VirtualAlloc OpenMutexW ReleaseMutex DeviceIoControl SetFilePointer GetDriveTypeW DefineDosDeviceW LoadLibraryW GetSystemDirectoryW MultiByteToWideChar GetPrivateProfileStringW GetTickCount VerifyVersionInfoW FreeLibrary GetVersionExW GetWindowsDirectoryW GetCurrentProcess VerSetConditionMask lstrcpyW FindNextFileW FindFirstFileW FindClose lstrlenW lstrcmpW LoadLibraryExW VirtualProtect ReadFile GetFileSize GetTimeZoneInformation WritePrivateProfileStringW GetVolumeInformationW GetDiskFreeSpaceExW WideCharToMultiByte GlobalLock GlobalUnlock GlobalAlloc GetComputerNameW GetLocalTime CreateProcessW GetExitCodeProcess WaitForSingleObject GetTempPathW WriteFile DeleteFileW CreateFileW GetPrivateProfileIntW GetProcAddress GetModuleHandleW GetModuleFileNameW Sleep CreateMutexW SetErrorMode CloseHandle CreateDirectoryW GetCommandLineW GetUserDefaultLCID FindResourceW SizeofResource LockResource LoadResource DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc GetLastError RaiseException GetConsoleMode DecodePointer

user32

EqualRect GetSysColor ScreenToClient MessageBoxW AdjustWindowRectEx GetWindowTextLengthW RemovePropW GetPropW RedrawWindow ValidateRect EndPaint BeginPaint GetForegroundWindow SetActiveWindow UpdateWindow SetMenu GetMenu GetCapture GetKeyState SetFocus GetDlgCtrlID GetDlgItem EndDeferWindowPos DeferWindowPos BeginDeferWindowPos GetWindowPlacement SetWindowPos DestroyWindow IsChild IsMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW GetMessageTime GetMessagePos PeekMessageW DispatchMessageW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps GetFocus PtInRect GetMenuItemCount GetMenuItemID GetParent SetRectEmpty SendDlgItemMessageA IsDialogMessageW CreateDialogIndirectParamW EndDialog UnregisterClassW GetWindowInfo AdjustWindowRect GetMenuBarInfo OffsetRect GetNextDlgTabItem GetWindowDC GetMenuItemInfoW FrameRect PrintWindow GetMonitorInfoW IsWindow GetWindowLongPtrW SetWindowLongW GetWindowLongW ReleaseDC GetDC TranslateAcceleratorW LoadAcceleratorsW SystemParametersInfoW SetPropW FillRect LoadCursorW SetCursor GetScrollPos SetScrollPos RemoveMenu ModifyMenuW AppendMenuW EnableMenuItem SetWindowLongPtrW GetClassLongPtrW GetClassNameW GetTopWindow GetLastActivePopup GetWindow SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx WinHelpW wsprintfW LoadImageW GetCursorPos InsertMenuItemW MonitorFromWindow ShowWindow MoveWindow EnableWindow InvalidateRect GetClientRect RegisterWindowMessageW SendMessageW UnregisterDeviceNotification PostMessageW WaitForInputIdle IsWindowVisible IsIconic SetTimer KillTimer GetSystemMetrics GetMenuState DrawMenuBar DestroyMenu CheckMenuItem GetSubMenu DrawIcon SetForegroundWindow GetWindowTextW GetWindowRect EnumWindows GetWindowThreadProcessId CheckMenuRadioItem LoadIconW OpenClipboard CloseClipboard SetClipboardData EmptyClipboard RegisterDeviceNotificationW CopyRect MonitorFromRect CreateMenu GetActiveWindow GetDesktopWindow GetMessageW TranslateMessage IsWindowEnabled DefWindowProcW CreatePopupMenu TrackPopupMenu SetWindowTextW PostQuitMessage RegisterClipboardFormatW DrawTextW DrawTextExW GrayStringW TabbedTextOutW ClientToScreen MessageBeep GetNextDlgGroupItem SetWindowContextHelpId IsRectEmpty SetRect InvalidateRgn CharNextW IntersectRect PostThreadMessageW ReleaseCapture SetCapture MapDialogRect RealChildWindowFromPoint GetSysColorBrush WindowFromPoint MapWindowPoints CharUpperW CopyAcceleratorTableW

gdi32

GetViewportExtEx GetWindowExtEx PtVisible RectVisible RestoreDC SaveDC ExtSelectClipRgn SetBkMode SetMapMode SetStretchBltMode GetStockObject TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx OffsetViewportOrgEx ScaleViewportExtEx ScaleWindowExtEx CreateRectRgnIndirect GetMapMode GetRgnBox GetClipBox Escape SetBkColor CreateBitmap SetBrushOrgEx CreateHalftonePalette CreatePatternBrush GetTextColor GetBkColor CreateSolidBrush MoveToEx GetObjectW CreateDIBSection SetTextColor StretchBlt SetBitmapBits SelectPalette SelectObject RealizePalette LineTo GetTextExtentPoint32W GetDeviceCaps GetBitmapBits DeleteObject DeleteDC CreatePen CreateFontIndirectW CreateCompatibleDC CreateCompatibleBitmap BitBlt EnumFontFamiliesExW

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

OpenSCManagerW RegCreateKeyExW RegDeleteValueW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegEnumValueW RegQueryValueW RegEnumKeyW RegDeleteKeyW ReportEventW RegisterEventSourceW DeregisterEventSource StartServiceW QueryServiceStatus OpenServiceW RegCloseKey CloseServiceHandle SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl FreeSid AllocateAndInitializeSid AddAccessAllowedAce

shell32

ShellExecuteW ord680 SHAppBarMessage Shell_NotifyIconW SHGetSpecialFolderPathW CommandLineToArgvW

comctl32

ImageList_ReplaceIcon _TrackMouseEvent InitCommonControlsEx

shlwapi

PathFindExtensionW PathFindFileNameW SHDeleteKeyW PathRemoveFileSpecW PathIsUNCW PathStripToRootW UrlCreateFromPathW

uxtheme

SetWindowTheme OpenThemeData CloseThemeData

ole32

OleUninitialize OleInitialize CoFreeUnusedLibraries CoInitialize CoGetClassObject CoTaskMemFree CoTaskMemAlloc CoInitializeSecurity CoSetProxyBlanket CoCreateInstance CoInitializeEx CoUninitialize CoRevokeClassObject OleFlushClipboard OleIsCurrentClipboard CoRegisterMessageFilter StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CLSIDFromString CreateILockBytesOnHGlobal CLSIDFromProgID CoCreateGuid

oleaut32

SafeArrayAccessData SafeArrayGetElemsize SafeArrayDestroy SafeArrayCreate VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen SafeArrayUnaccessData DispCallFunc LoadRegTypeLi VariantCopy VariantChangeType SysAllocStringLen SafeArrayGetElement VariantClear VariantInit SysAllocString SysFreeString OleCreateFontIndirect

winmm

mciSendCommandW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

wintrust

WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WinVerifyTrust WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW CM_Get_Device_IDW SetupDiEnumDeviceInfo

oleacc

LresultFromObject CreateStdAccessibleObject

Name

.text

Size

919KB

Virtual Size

919KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

301KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_3784b33e2b4775ce61db8bc36d2bbd2d_cobalt-strike_icedid_njrat_satacom_vidar

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

winmm

version

wintrust

crypt32

setupapi

oleacc

generic