2026-08-07_be43ad71880e5107f8e930bccde0bb54_cobalt-strike_icedid_njrat_poet-rat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_be43ad71880e5107f8e930bccde0bb54_cobalt-strike_icedid_njrat_poet-rat_satacom_stealc_vidar
Size 41.7MB
Sample260807-ebe95sfm2w
SHA256 02b8b47afa853d9cb6464b3906cb32901a9db4cfa569f8d3e884bc79200fdf0d
MD5 be43ad71880e5107f8e930bccde0bb54
SHA1 aeb3bbf86f2fc68fcd44ffb0121bb3fcfd8af6a8
SHA512 9a9966fca7da66f4628370c57ff360c198c76a377bc27f438f24fd19cda8da763ca2178d91ae6b793b8ea3bb522211021ac18b85bdc31831e4db58f6a17e9247
SSDEEP 786432:IXz+vETV/hBbERjRURg2DUxQYtGQAPD2VBqvJhbvr/lINcXdu/mAYk7:eJ/hBm2DUxQYtRAb2VBqvbvrdINcB
TLSH
T1CAA7CF16629C02DCE07AF1788687A603E7F17C0D0335EEEB56D14D671F6F6E0AA7A601
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_be43ad71880e5107f8e930bccde0bb54_cobalt-strike_icedid_njrat_poet-rat_satacom_stealc_vidar

File Explorer

2026-08-07_be43ad71880e5107f8e930bccde0bb54_cobalt-strike_icedid_njrat_poet-rat_satacom_stealc_vidar

.exe 41.7MB

2026-08-07_be43ad71880e5107f8e930bccde0bb54_cobalt-strike_icedid_njrat_poet-rat_satacom_stealc_vidar

IMPHASH 4d89410137344548277a929f1bc16f84
SHA256 02b8b47afa853d9cb6464b3906cb32901a9db4cfa569f8d3e884bc79200fdf0d
MD5 be43ad71880e5107f8e930bccde0bb54
SHA1 aeb3bbf86f2fc68fcd44ffb0121bb3fcfd8af6a8
SHA512 9a9966fca7da66f4628370c57ff360c198c76a377bc27f438f24fd19cda8da763ca2178d91ae6b793b8ea3bb522211021ac18b85bdc31831e4db58f6a17e9247
SSDEEP 786432:IXz+vETV/hBbERjRURg2DUxQYtGQAPD2VBqvJhbvr/lINcXdu/mAYk7:eJ/hBm2DUxQYtRAb2VBqvbvrdINcB
TLSH
T1CAA7CF16629C02DCE07AF1788687A603E7F17C0D0335EEEB56D14D671F6F6E0AA7A601
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7200336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DReflect D3DCompile

dxgi

CreateDXGIFactory1

dwmapi

DwmExtendFrameIntoClientArea

ole32

CoInitializeEx CoTaskMemFree CoCreateInstance

winmm

timeBeginPeriod timeEndPeriod PlaySoundA

winhttp

WinHttpOpenRequest WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpReceiveResponse WinHttpCrackUrl WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpAddRequestHeaders WinHttpQueryHeaders

bcrypt

BCryptFinishHash BCryptGetProperty BCryptCreateHash BCryptHashData BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyHash

user32

OpenClipboard SetClipboardData MonitorFromPoint SystemParametersInfoW SystemParametersInfoA LoadImageW FindWindowW SetWindowLongPtrW GetWindowLongPtrW CloseClipboard RedrawWindow InvalidateRect SetWindowRgn SetForegroundWindow SetActiveWindow GetClipboardData UpdateWindow SetFocus IsIconic IsWindowVisible SetWindowDisplayAffinity SetLayeredWindowAttributes UnregisterClassW GetDoubleClickTime PostQuitMessage PostMessageW SendMessageW PeekMessageW DispatchMessageW TranslateMessage wsprintfW SetWindowPos ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW MessageBoxA GetWindowThreadProcessId GetDesktopWindow MapVirtualKeyA SendInput GetAsyncKeyState GetWindowRect GetSystemMetrics SetProcessDPIAware LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseDC GetDC GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState DefWindowProcW GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard

gdi32

BitBlt CreateCompatibleBitmap DeleteObject GetDeviceCaps CreateCompatibleDC GetStockObject SetStretchBltMode StretchBlt SelectObject GetDIBits DeleteDC

shell32

SHGetFolderPathA ShellExecuteA ShellExecuteW

comdlg32

GetOpenFileNameA

advapi32

RegCreateKeyExA EventUnregister EventWriteTransfer EventSetInformation EventRegister RegCloseKey RegQueryValueExW RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA AllocateAndInitializeSid CheckTokenMembership RegGetValueW RegDeleteTreeA RegSetValueExW RegOpenKeyExW RegEnumValueA RegEnumKeyExA RegDeleteValueW FreeSid

xinput1_4

ord2

dinput8

DirectInput8Create

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW

hid

HidP_GetCaps HidD_GetAttributes HidD_GetInputReport HidD_FreePreparsedData HidD_GetPreparsedData HidD_GetHidGuid

iphlpapi

IcmpCloseHandle IcmpSendEcho IcmpCreateFile

kernel32

EnterCriticalSection GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns InitOnceComplete InitOnceBeginInitialize RaiseException RtlPcToFileHeader GetExitCodeThread WaitForSingleObjectEx LeaveCriticalSection InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue LoadLibraryExW OutputDebugStringW CreateFileMappingA UnmapViewOfFile MapViewOfFile GetProcessHeap HeapFree HeapReAlloc FlsFree EncodePointer RtlUnwind CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle GetCurrentProcess ExitProcess GetCommandLineA GetCommandLineW IsProcessorFeaturePresent HeapAlloc GetSystemPowerStatus lstrcatA lstrcpyA RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetFileType GetConsoleOutputCP GetConsoleMode ReadConsoleW SetFilePointerEx GetTimeZoneInformation FindFirstFileExW IsValidCodePage FormatMessageA CreateProcessA GetACP GetOEMCP GetExitCodeProcess TerminateProcess CreateMutexW CreatePipe SetHandleInformation GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW HeapSize SetEndOfFile GetStartupInfoW GetProcAddress OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA WriteConsoleW LoadLibraryA GetLocaleInfoA IsDBCSLeadByte GetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW GetFileAttributesExW WriteFile GetTempPathW CloseHandle WaitForSingleObject SetWaitableTimer CreateWaitableTimerExW Sleep CreateWaitableTimerW GetCurrentThread SetThreadPriority GetTickCount GetTickCount64 GetModuleFileNameW GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW LoadLibraryW MoveFileExW CompareStringOrdinal CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLastError GetVolumeInformationA GlobalMemoryStatusEx GetSystemInfo GetComputerNameA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA FlushFileBuffers GetDriveTypeA GetFileAttributesA GetFileSizeEx GetLogicalDrives ReadFile CopyFileA MoveFileExA GetEnvironmentVariableA CreateDirectoryA GetModuleFileNameA SetUnhandledExceptionFilter GetCurrentProcessId GetTempPathA FindFirstFileW FindNextFileW

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

Name

.text

Size

7.1MB

Virtual Size

7.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8.7MB

Virtual Size

8.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

46KB

Virtual Size

355KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

25.9MB

Virtual Size

25.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_be43ad71880e5107f8e930bccde0bb54_cobalt-strike_icedid_njrat_poet-rat_satacom_stealc_vidar

d3d11

d3dcompiler_47

dxgi

dwmapi

ole32

winmm

winhttp

bcrypt

user32

gdi32

shell32

comdlg32

advapi32

xinput1_4

dinput8

setupapi

hid

iphlpapi

kernel32

imm32

generic