2026-08-03_5e2b49a6dd4b4364a49290900d11b1e8_cobalt-strike_icedid_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_5e2b49a6dd4b4364a49290900d11b1e8_cobalt-strike_icedid_satacom_stealc_vidar
Size 21.2MB
Sample260804-ddbjas1ara
SHA256 1621ff09e8e82079c972e1e32619392566eeb1defe82eb39d927de4b22a2e5d8
MD5 5e2b49a6dd4b4364a49290900d11b1e8
SHA1 7ec711b91bb8c7b7b50653e255e98c3537836a2e
SHA512 2222dad5202fe409fc3bc577c19b80eadde0f4fd9f419def4f0b1ff8f6aeda2513f6c72f6f8d40b8df263b5751f2f62c13e761d05e38bc99abfe65068c1731a5
SSDEEP 49152:o1ZP0sY/w/yNEWjR+QX3jkjZZ/SrDCZi9sYoZuDzlp5UFxelEEBEkaq1c+pF8HdQ:HII5jRhkbafCYoZcz6FxZXCekj6y5Om
TLSH
T13C2789182D4CA35EE651B43E6A3385875FF2AF490199D9C2E6F1FE570EBF4813A1C281
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_5e2b49a6dd4b4364a49290900d11b1e8_cobalt-strike_icedid_satacom_stealc_vidar

File Explorer

2026-08-03_5e2b49a6dd4b4364a49290900d11b1e8_cobalt-strike_icedid_satacom_stealc_vidar

.exe 21.2MB

2026-08-03_5e2b49a6dd4b4364a49290900d11b1e8_cobalt-strike_icedid_satacom_stealc_vidar

IMPHASH 99cf8eb41fd8c3df7baa17298b1399e4
SHA256 1621ff09e8e82079c972e1e32619392566eeb1defe82eb39d927de4b22a2e5d8
MD5 5e2b49a6dd4b4364a49290900d11b1e8
SHA1 7ec711b91bb8c7b7b50653e255e98c3537836a2e
SHA512 2222dad5202fe409fc3bc577c19b80eadde0f4fd9f419def4f0b1ff8f6aeda2513f6c72f6f8d40b8df263b5751f2f62c13e761d05e38bc99abfe65068c1731a5
SSDEEP 49152:o1ZP0sY/w/yNEWjR+QX3jkjZZ/SrDCZi9sYoZuDzlp5UFxelEEBEkaq1c+pF8HdQ:HII5jRhkbafCYoZcz6FxZXCekj6y5Om
TLSH
T13C2789182D4CA35EE651B43E6A3385875FF2AF490199D9C2E6F1FE570EBF4813A1C281
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22142976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

GetUserNameW RegSetValueExA RegCreateKeyExA RegCloseKey

kernel32

GetTempPathA GetLastError Process32NextW Process32FirstW CloseHandle CreateThread SetFileAttributesA Sleep GetProcAddress GetComputerNameW WideCharToMultiByte GetConsoleWindow GetTickCount GetComputerNameA SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess CreateFileW TerminateProcess WriteFile GetCurrentProcess GetModuleFileNameA Beep IsValidCodePage HeapReAlloc ReadConsoleW ReadFile CreateProcessW GetExitCodeProcess WaitForSingleObject EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW ExitThread FreeLibraryAndExitThread GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree RtlUnwind

user32

SetCursorPos ShowWindow DrawIcon GetSystemMetrics LoadIconW SystemParametersInfoA GetDC GetCursorPos ReleaseDC

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC GetObjectW DeleteObject

shell32

SHChangeNotify SHGetFolderPathW SHGetFolderPathA

wininet

InternetConnectA HttpOpenRequestA InternetOpenW InternetCloseHandle HttpSendRequestA

winmm

mciSendStringA

Name

.text

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcdata1

Size

52KB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rcdata1

Size

100KB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rcdata1

Size

84KB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rcdata1

Size

68KB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rcdata1

Size

52KB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_5e2b49a6dd4b4364a49290900d11b1e8_cobalt-strike_icedid_satacom_stealc_vidar

advapi32

kernel32

user32

gdi32

shell32

wininet

winmm

generic