2026-08-05_41a0c97942226420958682de1e6ebbc4_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-08-05_41a0c97942226420958682de1e6ebbc4_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.7MB
Sample260806-csdrjack5t
SHA256 81408557cca957b98b1cc29f3046a19e91a412950a5a0aa7cc30c5931b8be77e
MD5 41a0c97942226420958682de1e6ebbc4
SHA1 5a59df26bd1f96d03d23360ef1e9e4866d7aaaf8
SHA512 d63ae038bf353fe029939f75039e57885d50c09fde104d3b9f3c1336f93d3f214860812c97af19e3d826b26d093c30b3c1ef861d8b44caa6ce607438c6405f9c
SSDEEP 24576:2w6aAGvASwRYJiemgXe4i7ojhsP5Lgrk1TWb4AN5:OGva6tpe30jaNf1TWbdz
TLSH
T19C85E08677544BF9E177C13CC6928B46F6B278492721A79F03E84AA60F237A11D3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_41a0c97942226420958682de1e6ebbc4_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-08-05_41a0c97942226420958682de1e6ebbc4_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.7MB

2026-08-05_41a0c97942226420958682de1e6ebbc4_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH d76d56bd82300fa3a43ab55b202ec152
SHA256 81408557cca957b98b1cc29f3046a19e91a412950a5a0aa7cc30c5931b8be77e
MD5 41a0c97942226420958682de1e6ebbc4
SHA1 5a59df26bd1f96d03d23360ef1e9e4866d7aaaf8
SHA512 d63ae038bf353fe029939f75039e57885d50c09fde104d3b9f3c1336f93d3f214860812c97af19e3d826b26d093c30b3c1ef861d8b44caa6ce607438c6405f9c
SSDEEP 24576:2w6aAGvASwRYJiemgXe4i7ojhsP5Lgrk1TWb4AN5:OGva6tpe30jaNf1TWbdz
TLSH
T19C85E08677544BF9E177C13CC6928B46F6B278492721A79F03E84AA60F237A11D3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

36080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\jenkins\workspace\dptf\Src\IPF\Windows\Solution\Build\x64\Release\ipfsvc.pdb

kernel32

GetModuleFileNameW OutputDebugStringA GetSystemDirectoryW FormatMessageA LocalFree ResetEvent ReleaseMutex CreateMutexW CreateEventW LoadLibraryExA GetProcAddress GetModuleHandleExA FreeLibrary CreateThread CreateSemaphoreW Sleep WaitForSingleObject ReleaseSemaphore AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetLastError CloseHandle GetFileAttributesA QueryPerformanceFrequency WriteConsoleW GetModuleFileNameA HeapAlloc HeapFree GetProcessHeap GetSystemDirectoryA SetEvent ReadConsoleW ReadFile HeapReAlloc HeapSize GetTimeZoneInformation SetFilePointerEx QueryPerformanceCounter GetFileSizeEx GetConsoleMode __C_specific_handler RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedPushEntrySList InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlUnwindEx EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetStdHandle WriteFile GetCommandLineA GetCommandLineW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetCurrentThread MultiByteToWideChar DeleteFileW RemoveDirectoryW GetStringTypeW WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW SetStdHandle OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetConsoleCtrlHandler FlushFileBuffers GetConsoleOutputCP RtlUnwind

advapi32

RegGetValueA StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey EventRegister EventWriteString EventProviderEnabled EventWrite EventUnregister

api-ms-win-service-core-l1-1-3

GetServiceRegistryStateKey

setupapi

CM_Get_Device_ID_ListA CM_Open_DevNode_Key CM_Locate_DevNodeA CM_Get_Device_Interface_List_SizeA CM_Get_Device_ID_List_SizeA

Name

.text

Size

377KB

Virtual Size

377KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_41a0c97942226420958682de1e6ebbc4_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

advapi32

api-ms-win-service-core-l1-1-3

setupapi

generic