2026-08-03_dbc88b7827eb0d1937d3cd6727f16aa8_cobalt-strike_icedid_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_dbc88b7827eb0d1937d3cd6727f16aa8_cobalt-strike_icedid_satacom_vidar
Size 297KB
Sample260803-cklr6sweqa
SHA256 2940cd8be4c8096199ca3f98c9c2e4a5357a969d4df6f0d7f639fd208a7850e8
MD5 dbc88b7827eb0d1937d3cd6727f16aa8
SHA1 1826a377dbcfffb95b432e8f93ea74395c483fbe
SHA512 13017c0f4cc4134cf78f7130728c7986db1505a3a8654fc4ed1ea3720151f45d4e1648c72854d89e79ec20d7fd8fd0b4b2d1341e72977db0dc41c3e40ea4d93c
SSDEEP 3072:bemDlmhxTJ6atxoPl+ua+huXlepwxl0W2eweHlR/YWLnA6jSNe9QAQkrDTG1Iqks:bempmhf6KxKy7btYUA6mN9krDqZIb8
TLSH
T1C1546C07E39540F8E86AC17C8A979122EA72B8450761F6DF17940B263F27BE49F3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_dbc88b7827eb0d1937d3cd6727f16aa8_cobalt-strike_icedid_satacom_vidar

File Explorer

2026-08-03_dbc88b7827eb0d1937d3cd6727f16aa8_cobalt-strike_icedid_satacom_vidar

.exe 297KB

2026-08-03_dbc88b7827eb0d1937d3cd6727f16aa8_cobalt-strike_icedid_satacom_vidar

IMPHASH 084e76df2777015a7ac2e7ab3863e406
SHA256 2940cd8be4c8096199ca3f98c9c2e4a5357a969d4df6f0d7f639fd208a7850e8
MD5 dbc88b7827eb0d1937d3cd6727f16aa8
SHA1 1826a377dbcfffb95b432e8f93ea74395c483fbe
SHA512 13017c0f4cc4134cf78f7130728c7986db1505a3a8654fc4ed1ea3720151f45d4e1648c72854d89e79ec20d7fd8fd0b4b2d1341e72977db0dc41c3e40ea4d93c
SSDEEP 3072:bemDlmhxTJ6atxoPl+ua+huXlepwxl0W2eweHlR/YWLnA6jSNe9QAQkrDTG1Iqks:bempmhf6KxKy7btYUA6mN9krDqZIb8
TLSH
T1C1546C07E39540F8E86AC17C8A979122EA72B8450761F6DF17940B263F27BE49F3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

154016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

hp-thermal.pdb

kernel32

EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection OpenMutexW RaiseException RtlPcToFileHeader OpenEventW EnterCriticalSection RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW UnhandledExceptionFilter IsDebuggerPresent CreateToolhelp32Snapshot Process32FirstW Process32NextW RtlVirtualUnwind DisconnectNamedPipe FlushFileBuffers CancelIoEx GetNamedPipeServerProcessId CreateFileW LocalFree RtlLookupFunctionEntry CreateNamedPipeW ConnectNamedPipe WaitForMultipleObjects RtlCaptureContext InitializeSListHead FreeLibrary WaitNamedPipeW AddVectoredExceptionHandler VirtualQuery GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentThreadStackLimits FindNextFileW GetOverlappedResult GetFileType FlsGetValue GetNamedPipeClientProcessId HeapSize SetFilePointerEx OpenProcess MoveFileExW TerminateProcess QueryFullProcessImageNameW SetProcessMitigationPolicy SetEvent ReadFile WriteFile GetCurrentProcessId SetLastError CreateThread GetProcessHeap HeapFree FormatMessageW FlsAlloc GetModuleHandleExW FlsFree FlsSetValue GetCurrentThread GetModuleHandleA IsThreadAFiber SleepEx WriteFileEx ReadFileEx HeapReAlloc HeapAlloc SetFileTime SetFileInformationByHandle GetFullPathNameW FindFirstFileExW FindClose GetFileInformationByHandle GetFileInformationByHandleEx SetThreadExecutionState DuplicateHandle CreateDirectoryW ExitProcess GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW GetExitCodeProcess GetTempPathW DeleteFileW GetFinalPathNameByHandleW SwitchToThread CopyFileExW CreateWaitableTimerExW SetWaitableTimer Sleep GetCurrentProcess LoadLibraryExA GetSystemDirectoryW GetProcAddress WaitForSingleObject GetLastError SetDefaultDllDirectories SetUnhandledExceptionFilter GetTickCount64 CreateMutexW CreateEventW GetModuleHandleW LoadLibraryExW ReleaseMutex CloseHandle FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCommandLineW GetEnvironmentVariableW GetCommandLineA IsValidCodePage GetACP GetOEMCP CompareStringOrdinal QueryPerformanceFrequency GetCPInfo LCMapStringW WideCharToMultiByte CompareStringW SetEnvironmentVariableW GetConsoleMode SetStdHandle GetStringTypeW GetConsoleOutputCP GetStdHandle MultiByteToWideChar WriteConsoleW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegCreateKeyExW StartServiceCtrlDispatcherW RegGetValueW RegisterServiceCtrlHandlerW SetServiceStatus ControlService GetSidSubAuthorityCount ConvertStringSecurityDescriptorToSecurityDescriptorW GetSidSubAuthority RegDeleteValueW RegDeleteKeyW RegDeleteTreeW GetNamedSecurityInfoW GetAce OpenProcessToken OpenSCManagerW OpenServiceW RegSetValueExW ChangeServiceConfig2W CloseServiceHandle ReportEventW LookupPrivilegeValueW IsWellKnownSid QueryServiceStatusEx CreateWellKnownSid RegisterEventSourceW StartServiceW GetTokenInformation EventWriteString EventRegister EventAccessControl AdjustTokenPrivileges

user32

TrackPopupMenu DestroyWindow CreatePopupMenu KillTimer GetKeyState SetForegroundWindow GetSystemMetrics DefWindowProcW SetDlgItemTextW GetWindowLongPtrW SetWindowLongPtrW DialogBoxParamW DestroyMenu AppendMenuW GetWindowThreadProcessId GetDlgItem MessageBoxW GetMessageW PostMessageW PostQuitMessage MsgWaitForMultipleObjects DispatchMessageW TranslateMessage PeekMessageW EndDialog LoadIconW GetCursorPos CreateWindowExW RegisterClassW SendMessageW SendMessageTimeoutW FindWindowExW SetTimer

comctl32

TaskDialogIndirect

shell32

ShellExecuteExW ShellExecuteW ExtractIconExW SHGetKnownFolderPath Shell_NotifyIconW

powrprof

SetSuspendState

oleaut32

SafeArrayAccessData SafeArrayGetUBound SysAllocStringLen SafeArrayUnaccessData SysFreeString SysStringLen GetErrorInfo VariantClear SafeArrayGetLBound SafeArrayCreateVector

ole32

CoInitializeEx CoInitializeSecurity CoCreateInstance CoUninitialize CoSetProxyBlanket

gdi32

SetTextColor GetStockObject SetBkMode

combase

CoCreateFreeThreadedMarshaler CoTaskMemFree

rstrtmgr

RmStartSession RmRegisterResources RmGetList RmEndSession

ntdll

NtWriteFile NtCreateNamedPipeFile RtlNtStatusToDosError NtOpenFile NtReadFile

Name

.text

Size

206KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dep-v0

Size

1024B

Virtual Size

666B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_dbc88b7827eb0d1937d3cd6727f16aa8_cobalt-strike_icedid_satacom_vidar

kernel32

api-ms-win-core-synch-l1-2-0

advapi32

user32

comctl32

shell32

powrprof

oleaut32

ole32

gdi32

combase

rstrtmgr

ntdll

generic