2026-08-03_441f439ab7e3c3685f1662184e636859_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_441f439ab7e3c3685f1662184e636859_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 1.3MB
Sample260804-pefeeswtf1
SHA256 280d8b9443715db075a190406558e2c2d494b4321778b765d5f6982a39898fcf
MD5 441f439ab7e3c3685f1662184e636859
SHA1 14f08d972622c93dedadd445adc96c58cff816c0
SHA512 04fecc1261180bf5c9b1d4b7a57091dce312aa15ec5d6d4e93cfe294aaac1228db9e277abb4e92e443f6d556385e2fb15a2cf97f928210153c4db28079f072da
SSDEEP 24576:9Zfz//rVsZ51P/5+l+03B7uOapql+YDR7x7Jw7iMd:DfTrVsNxDOOn
TLSH
T13E558D95A5F64AA4FD71D07C80869608C967FC662321CB7BCEA2B7710F3B2B35817631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_441f439ab7e3c3685f1662184e636859_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-08-03_441f439ab7e3c3685f1662184e636859_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 1.3MB

2026-08-03_441f439ab7e3c3685f1662184e636859_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH 7e349b0a67568cd36fe2ab14fd814c8b
SHA256 280d8b9443715db075a190406558e2c2d494b4321778b765d5f6982a39898fcf
MD5 441f439ab7e3c3685f1662184e636859
SHA1 14f08d972622c93dedadd445adc96c58cff816c0
SHA512 04fecc1261180bf5c9b1d4b7a57091dce312aa15ec5d6d4e93cfe294aaac1228db9e277abb4e92e443f6d556385e2fb15a2cf97f928210153c4db28079f072da
SSDEEP 24576:9Zfz//rVsZ51P/5+l+03B7uOapql+YDR7x7Jw7iMd:DfTrVsNxDOOn
TLSH
T13E558D95A5F64AA4FD71D07C80869608C967FC662321CB7BCEA2B7710F3B2B35817631
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1286144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

MultiByteToWideChar WideCharToMultiByte LoadLibraryW GetProcAddress FreeLibrary LocalAlloc lstrcmpA SetCurrentDirectoryW LocalFree CloseHandle HeapSize GetConsoleOutputCP GetLastError GetFileAttributesW FindClose GetModuleFileNameW FlushFileBuffers GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW WriteConsoleW GetModuleHandleW IsDebuggerPresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetLocaleInfoEx GetStringTypeW CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCurrentDirectoryW HeapFree HeapAlloc GetFullPathNameW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle SetFilePointerEx GetConsoleMode HeapReAlloc GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW

user32

MessageBoxA

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW

wintrust

WinVerifyTrust

crypt32

CryptMsgClose CertFreeCertificateContext CryptQueryObject CertCloseStore CryptMsgGetParam CertFindCertificateInStore CertGetNameStringA CryptDecodeObject

Name

.text

Size

353KB

Virtual Size

352KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.avm0

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.avm1

Size

128KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.idata

Size

48KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rcdf1b

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_441f439ab7e3c3685f1662184e636859_cobalt-strike_icedid_njrat_satacom_stealc_vidar

kernel32

user32

advapi32

wintrust

crypt32

generic