2026-08-08_d9a6c117e7ec098e5a66e3194eca8b35_cobalt-strike_icedid_njrat_satacom_stealc_vidar

General

Target
2026-08-08_d9a6c117e7ec098e5a66e3194eca8b35_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 1.5MB
Sample260808-c3webs1wfs
SHA256 5afe82b9c9cac73c56d381a468e53f815e2f82fdd29dd1c7f6b3e5cd0a8f3ecc
MD5 d9a6c117e7ec098e5a66e3194eca8b35
SHA1 e11337a7d71658b66bcab60e3c2b8a8e80e3c3e2
SHA512 aca0cd8f8115b8f0715d4badb3c5209775cd7998fadf0a274554fee1ece64e4f110dc51492d57f5fbe454378e96fd1867f26e383567ff87750159b92f14d6c6d
SSDEEP 24576:yJhvOjCg7EfNtcOe1Epz2rBBSyrqJGfsbIVxLvbqYarRBoX1OcqV+VFEdEmup9qL:yJhmj8HcNGz2FBS0ffsIVxLTnaP0OD+W
TLSH
T1DC658F0BB3B400EDD457C27989169A07EBB178051774ABDF17D08A6A6F63EE11E7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_d9a6c117e7ec098e5a66e3194eca8b35_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-08-08_d9a6c117e7ec098e5a66e3194eca8b35_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 1.5MB

2026-08-08_d9a6c117e7ec098e5a66e3194eca8b35_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH 28b624fb06d53e1a05624dbfd372d92a
SHA256 5afe82b9c9cac73c56d381a468e53f815e2f82fdd29dd1c7f6b3e5cd0a8f3ecc
MD5 d9a6c117e7ec098e5a66e3194eca8b35
SHA1 e11337a7d71658b66bcab60e3c2b8a8e80e3c3e2
SHA512 aca0cd8f8115b8f0715d4badb3c5209775cd7998fadf0a274554fee1ece64e4f110dc51492d57f5fbe454378e96fd1867f26e383567ff87750159b92f14d6c6d
SSDEEP 24576:yJhvOjCg7EfNtcOe1Epz2rBBSyrqJGfsbIVxLvbqYarRBoX1OcqV+VFEdEmup9qL:yJhmj8HcNGz2FBS0ffsIVxLTnaP0OD+W
TLSH
T1DC658F0BB3B400EDD457C27989169A07EBB178051774ABDF17D08A6A6F63EE11E7E320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1065508

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetVersionExA GetModuleHandleA LoadLibraryA LocalFree MultiByteToWideChar FlushFileBuffers GetTickCount QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime WideCharToMultiByte FreeLibrary GetModuleHandleW SystemTimeToFileTime GetProcessHeap GetCurrentProcessId GetFileSize LockFileEx GetProcAddress UnlockFile HeapDestroy HeapCompact HeapAlloc LoadLibraryW GetSystemInfo CloseHandle HeapReAlloc DeleteFileW DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetLastError GetDiskFreeSpaceA FormatMessageW GetTempPathA Sleep HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW WaitForSingleObject CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapFree HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW SetEnvironmentVariableW RtlPcToFileHeader RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle GetFileType GetModuleFileNameW WriteConsoleW ExitProcess CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation SetStdHandle FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_d9a6c117e7ec098e5a66e3194eca8b35_cobalt-strike_icedid_njrat_satacom_stealc_vidar

kernel32

generic