2026-08-09_8e610c012fb77ab60dd7a1fc67ad0a55_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_8e610c012fb77ab60dd7a1fc67ad0a55_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.5MB
Sample260809-ppzaaa1tcz
SHA256 1789972c3e75a1de4d4db8408c5c23f652d4bc5f77cedeb94b2c1f5ffbfc9168
MD5 8e610c012fb77ab60dd7a1fc67ad0a55
SHA1 aebd6ca7d0a6d82821ac1ce469b484ace73f9be5
SHA512 a2ab7d17adc66d656cbcaa8ee53e75bcc6de8142a8bd2f4bcfd5f85695c733c49aa8d2ea95194cfe25e75fdb573693824a2786dd08676e9ceadcb009b35612a0
SSDEEP 24576:R+jKcDL9a6SLrsqjnhMgeiCl7G0nehbGZpbD:8Kcn9jSDDmg27RnWGj
TLSH
T18075E16AF36811F6D867C17CCA83C506EA327C1543209ADB27A096AA3F375D46E3DF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_8e610c012fb77ab60dd7a1fc67ad0a55_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-08-09_8e610c012fb77ab60dd7a1fc67ad0a55_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.5MB

2026-08-09_8e610c012fb77ab60dd7a1fc67ad0a55_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 6e5807424706a5f8688edda311d0ef84
SHA256 1789972c3e75a1de4d4db8408c5c23f652d4bc5f77cedeb94b2c1f5ffbfc9168
MD5 8e610c012fb77ab60dd7a1fc67ad0a55
SHA1 aebd6ca7d0a6d82821ac1ce469b484ace73f9be5
SHA512 a2ab7d17adc66d656cbcaa8ee53e75bcc6de8142a8bd2f4bcfd5f85695c733c49aa8d2ea95194cfe25e75fdb573693824a2786dd08676e9ceadcb009b35612a0
SSDEEP 24576:R+jKcDL9a6SLrsqjnhMgeiCl7G0nehbGZpbD:8Kcn9jSDDmg27RnWGj
TLSH
T18075E16AF36811F6D867C17CCA83C506EA327C1543209ADB27A096AA3F375D46E3DF11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

132464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qb\workspace\21461\source\output\dump64\miniport\IntelCpLSPCONSvc\Release\IntelCpHDCPSvc.pdb

kernel32

GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW ReadFile WriteFile ReleaseMutex GetCommandLineW CreateFileW HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap SleepEx GetCurrentProcess FlushFileBuffers GetModuleFileNameW FindClose GetConsoleOutputCP GetConsoleMode SetFilePointerEx LCMapStringW GetCurrentThreadId OutputDebugStringA CreateThread CreateSemaphoreExW ReleaseSemaphore SetEvent CloseHandle WriteConsoleW GetVersion GetModuleHandleA LoadLibraryW GetProcAddress GetCurrentProcessId DeleteCriticalSection GetFileType FreeLibrary EnterCriticalSection LeaveCriticalSection GetModuleHandleW LoadLibraryExW LoadResource SizeofResource FindResourceW lstrcmpiW MultiByteToWideChar InitializeCriticalSectionEx GetLastError RaiseException DecodePointer Sleep CreateEventW WaitForSingleObject QueryPerformanceFrequency GetStdHandle GetModuleHandleExW ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc WaitForMultipleObjects DeviceIoControl CreateMutexW QueryPerformanceCounter EncodePointer SetLastError RtlPcToFileHeader RtlUnwindEx OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryEnterCriticalSection FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter

advapi32

LookupPrivilegeValueW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW EventWriteTransfer RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey EventUnregister EventRegister NotifyServiceStatusChangeW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW AdjustTokenPrivileges OpenProcessToken

user32

GetWindowRect EnumChildWindows EnumDisplayDevicesW MessageBoxW IsChild CharUpperW PostThreadMessageW DispatchMessageW TranslateMessage GetMessageW LoadStringW GetDisplayConfigBufferSizes QueryDisplayConfig CharNextW

oleaut32

VariantInit VariantClear SafeArrayCopy SafeArrayUnlock SafeArrayLock SafeArrayGetLBound SafeArrayGetUBound SysFreeString SafeArrayRedim SafeArrayDestroy SafeArrayCreate LoadRegTypeLi LoadTypeLi VarUI4FromStr SysStringLen SafeArrayGetVartype

setupapi

CM_Get_Device_Interface_ListW CM_Get_Device_Interface_List_SizeW

ole32

CoTaskMemRealloc CoInitializeSecurity CoInitializeEx CoUninitialize CoTaskMemFree CoTaskMemAlloc CoReleaseServerProcess CoCreateInstance CoAddRefServerProcess CoSetProxyBlanket CoRevokeClassObject OleRun

api-ms-win-devices-config-l1-1-1

CM_MapCrToWin32Err CM_Register_Notification CM_Unregister_Notification

ntdll

RtlInitAnsiString RtlAnsiStringToUnicodeString RtlFreeUnicodeString

Name

.text

Size

210KB

Virtual Size

210KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_8e610c012fb77ab60dd7a1fc67ad0a55_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

advapi32

user32

oleaut32

setupapi

ole32

api-ms-win-devices-config-l1-1-1

ntdll

generic