2026-08-07_3b11f33196ab542a0e2887b5a546051c_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-08-07_3b11f33196ab542a0e2887b5a546051c_cobalt-strike_icedid_njrat_satacom_vidar
Size 610KB
Sample260807-trkl5agr21
SHA256 bf05866896bf7a41211842a20c56581f8707c7c1a08a538d28bcf271525cf020
MD5 3b11f33196ab542a0e2887b5a546051c
SHA1 ce837b42b50c5a94cc270089f4fe7b43cb0f60ce
SHA512 5468edbf9a76d38f49af064343a31fcc92c006936b1cf230f3961ab2bc254cfb298ec89e598f2e7862792d2fda238ef2c7011b713fb3284769e326e0c3351b95
SSDEEP 12288:w9DnBciCZoY0PYleRwKE9bhSmLEYautNNYI+OvWxxkQ:CpBYFF9QYauoOeHZ
TLSH
T113D47E1A62A402FCD4BBD179C9529917FBB2780A03649BDF03A14A672F676E04F3D770
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_3b11f33196ab542a0e2887b5a546051c_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-08-07_3b11f33196ab542a0e2887b5a546051c_cobalt-strike_icedid_njrat_satacom_vidar

.exe 610KB

2026-08-07_3b11f33196ab542a0e2887b5a546051c_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 7cf120d90639e8de460ff68a3fda94ac
SHA256 bf05866896bf7a41211842a20c56581f8707c7c1a08a538d28bcf271525cf020
MD5 3b11f33196ab542a0e2887b5a546051c
SHA1 ce837b42b50c5a94cc270089f4fe7b43cb0f60ce
SHA512 5468edbf9a76d38f49af064343a31fcc92c006936b1cf230f3961ab2bc254cfb298ec89e598f2e7862792d2fda238ef2c7011b713fb3284769e326e0c3351b95
SSDEEP 12288:w9DnBciCZoY0PYleRwKE9bhSmLEYautNNYI+OvWxxkQ:CpBYFF9QYauoOeHZ
TLSH
T113D47E1A62A402FCD4BBD179C9529917FBB2780A03649BDF03A14A672F676E04F3D770
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

274272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

W:\Projects\git_WolfSave\x64\Release\WolfSave.pdb

kernel32

ReadFile GetCommandLineW CreateFileW UnmapViewOfFile MultiByteToWideChar CloseHandle LocalFree GetFileSize WideCharToMultiByte SetEndOfFile WriteConsoleW HeapSize FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime IsDebuggerPresent GetStartupInfoW RtlUnwindEx InterlockedPushEntrySList RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap RtlUnwind

shell32

CommandLineToArgvW

Name

.text

Size

469KB

Virtual Size

468KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

109KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_3b11f33196ab542a0e2887b5a546051c_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

shell32

generic