2026-08-02_c7eb3a3bd04022c201497e41611c3387_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_c7eb3a3bd04022c201497e41611c3387_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 1.2MB
Sample260802-jv2ppsxhlc
SHA256 d2cd579aabd75c8ad36a1ab37db17255e62671d3ae893f224e45ade048544cc3
MD5 c7eb3a3bd04022c201497e41611c3387
SHA1 c6c5f305c2a4fbb75a7303a60897f6d6605bddb2
SHA512 2a091261673f344180bd43bdd5547e73872f840e5d5edcce02cafe8a8830fa8e35b15e6f742dc60d9c7ce4c2c398dc6bb2656baaebd524afe89753702fd06120
SSDEEP 24576:5ILhT+MHRvhBvVtZPRgJfHPSo/KeSYqltj6AJ8GkYz:5ILhT+avhNgJCoSeSYqltE0
TLSH
T1974549456E9BC4E9D17BA17FCA460D42E5BEF601071396CB0B905A753F23AD30D3A3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-08-02_c7eb3a3bd04022c201497e41611c3387_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 1.2MB

2026-08-02_c7eb3a3bd04022c201497e41611c3387_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH 69378ff93da90cfd6e740d45d1d62099
SHA256 d2cd579aabd75c8ad36a1ab37db17255e62671d3ae893f224e45ade048544cc3
MD5 c7eb3a3bd04022c201497e41611c3387
SHA1 c6c5f305c2a4fbb75a7303a60897f6d6605bddb2
SHA512 2a091261673f344180bd43bdd5547e73872f840e5d5edcce02cafe8a8830fa8e35b15e6f742dc60d9c7ce4c2c398dc6bb2656baaebd524afe89753702fd06120
SSDEEP 24576:5ILhT+MHRvhBvVtZPRgJfHPSo/KeSYqltj6AJ8GkYz:5ILhT+avhNgJCoSeSYqltE0
TLSH
T1974549456E9BC4E9D17BA17FCA460D42E5BEF601071396CB0B905A753F23AD30D3A3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

8a:1e:f7:57:87:fb:9c:a9:4d:8f:97:b7:c8:5e:39:3e:6e:2c:e9:44:ab:07:17:fa:a5:1e:07:36:65:7d:1d:45

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 31, 2026

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

8a:1e:f7:57:87:fb:9c:a9:4d:8f:97:b7:c8:5e:39:3e:6e:2c:e9:44:ab:07:17:fa:a5:1e:07:36:65:7d:1d:45

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=NVIDIA Corporation,OU=1004yx4,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Chains

Feb 12, 2026

CN=NVIDIA Corporation,OU=1004yx4,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=NVIDIA Corporation,OU=1004yx4,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=NVIDIA Corporation,OU=1004yx4,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

Serial Number

03:f4:98:b5:5d:db:8a:b5:d3:61:f2:96:8f:79:04:95

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 2, 2025 - Jul 5, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:3d:8f:4d:d7:78:62:f0:ad:20:00:00:00:00:01:3d

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 13, 2025 - Nov 10, 2026

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

434800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\gcomp\rel\src\NvContainer\_out\x86_64\release\container\NvContainer.pdb

shlwapi

PathIsRelativeW

kernel32

LocalAlloc LocalFree ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW OutputDebugStringA Sleep GetCurrentThreadId ProcessIdToSessionId GetSystemTime GetSystemTimeAsFileTime CreateTimerQueueTimer DeleteTimerQueueTimer GetModuleFileNameW GetModuleHandleExW MoveFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW FreeLibrary FindCloseChangeNotification FindFirstChangeNotificationW FindNextChangeNotification GetCurrentDirectoryW SetLastError GetErrorMode SetErrorMode LoadLibraryExW VerSetConditionMask GetCurrentProcessId GetFullPathNameW CreateProcessA CreateProcessW GetSystemDirectoryW GetModuleFileNameA VerifyVersionInfoW MultiByteToWideChar WideCharToMultiByte RemoveDirectoryW DeviceIoControl VirtualQuery VirtualProtect GetSystemInfo WriteConsoleW HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage OutputDebugStringW GetStringTypeW HeapReAlloc ReadConsoleW ReadFile SetStdHandle GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetLastError GetProcAddress GetModuleHandleA RemoveVectoredContinueHandler AddVectoredContinueHandler RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetUnhandledExceptionFilter RtlCaptureStackBackTrace GetModuleHandleW OpenProcess RtlUnwind CreateThread WaitForMultipleObjects OpenEventW CreateEventW WaitForSingleObject SetEvent CloseHandle GetCurrentProcess GetProcessTimes SetDefaultDllDirectories LoadLibraryExA CreateFileW FormatMessageA SetCurrentDirectoryW FindFirstFileExW GetDiskFreeSpaceExW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW SetEndOfFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime GetTempPathW AreFileApisANSI CreateDirectoryExW CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedPushEntrySList InterlockedFlushSList RtlPcToFileHeader RaiseException RtlUnwindEx EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetFileType GetCPInfo GetStdHandle WriteFile GetCurrentThread HeapAlloc HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleCtrlHandler FlushFileBuffers

user32

LoadStringW PostThreadMessageW PeekMessageW GetMessageW ShutdownBlockReasonDestroy ShutdownBlockReasonCreate SetWindowLongPtrW GetWindowLongPtrW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW PostMessageW DispatchMessageW TranslateMessage

shell32

SHGetKnownFolderPath CommandLineToArgvW

ole32

CoTaskMemFree

advapi32

RegisterServiceCtrlHandlerExW RegSetKeyValueW RegOpenKeyExW RegGetValueW RegDeleteValueW GetUserNameW BuildExplicitAccessWithNameW SetSecurityInfo GetSecurityInfo SetEntriesInAclW StartServiceCtrlDispatcherW SetServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle ChangeServiceConfigW RegSetValueExW RegCreateKeyExW RegCloseKey LookupAccountSidW CreateWellKnownSid OpenProcessToken

Name

.text

Size

845KB

Virtual Size

844KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

183KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_c7eb3a3bd04022c201497e41611c3387_cobalt-strike_icedid_njrat_satacom_stealc_vidar

shlwapi

kernel32

user32

shell32

ole32

advapi32

generic