2026-08-02_37f6015b5a25ebb76ea518e63ea33c83_cobalt-strike_icedid_njrat_ryuk_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_37f6015b5a25ebb76ea518e63ea33c83_cobalt-strike_icedid_njrat_ryuk_satacom_stealc_vidar
Size 734KB
Sample260802-xpe6eawsbt
SHA256 dbacfbaf98987aa105ca8c2066699a2688677e27462cccc0c75d3b97d581b939
MD5 37f6015b5a25ebb76ea518e63ea33c83
SHA1 b85c175d133fe7ff4782146816e80a4c020edbbb
SHA512 36bd99c04bbc7c718eb697a682579feb441361a565aa375cab7bb8624cd41420d38b9269c0cb8a635e198a659b42267609b38bfd1ae0420e531c4f915b323b46
SSDEEP 12288:8V6naIDKGXG1+cPrl92Yhtsj/tj08Cb3eQFaBrPdMafgNcrCxfM5Al7bWp:LnHGGXG1zTHfhSjrCjtarLoNDE5ANC
TLSH
T169F48D17EA8051E8C07DC17E8B669727E7B1BC0516A0F64F2BD05A161F33B58AF2EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_37f6015b5a25ebb76ea518e63ea33c83_cobalt-strike_icedid_njrat_ryuk_satacom_stealc_vidar

File Explorer

2026-08-02_37f6015b5a25ebb76ea518e63ea33c83_cobalt-strike_icedid_njrat_ryuk_satacom_stealc_vidar

.exe 734KB

2026-08-02_37f6015b5a25ebb76ea518e63ea33c83_cobalt-strike_icedid_njrat_ryuk_satacom_stealc_vidar

IMPHASH 511a9f08ad049024ceadb3547f453c54
SHA256 dbacfbaf98987aa105ca8c2066699a2688677e27462cccc0c75d3b97d581b939
MD5 37f6015b5a25ebb76ea518e63ea33c83
SHA1 b85c175d133fe7ff4782146816e80a4c020edbbb
SHA512 36bd99c04bbc7c718eb697a682579feb441361a565aa375cab7bb8624cd41420d38b9269c0cb8a635e198a659b42267609b38bfd1ae0420e531c4f915b323b46
SSDEEP 12288:8V6naIDKGXG1+cPrl92Yhtsj/tj08Cb3eQFaBrPdMafgNcrCxfM5Al7bWp:LnHGGXG1zTHfhSjrCjtarLoNDE5ANC
TLSH
T169F48D17EA8051E8C07DC17E8B669727E7B1BC0516A0F64F2BD05A161F33B58AF2EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

381108

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockShared AreFileApisANSI CloseHandle CompareStringW CreateDirectoryW CreateFileW DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileAttributesExW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GlobalFree HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockShared RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFileInformationByHandle SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WideCharToMultiByte WriteConsoleW WriteFile

gdiplus

GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipSaveImageToStream

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

Name

.text

Size

537KB

Virtual Size

537KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

79KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

156B

Characteristics

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_37f6015b5a25ebb76ea518e63ea33c83_cobalt-strike_icedid_njrat_ryuk_satacom_stealc_vidar

kernel32

gdiplus

advapi32

generic