2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.6MB
Sample260810-w81e1saa39
SHA256 d29bb5b68976907100fd974c4278aefa69a18d1f99bdd3be9a5ae591659f5bbc
MD5 7142be36072b612033c269b9e0ba64cc
SHA1 aba9501d15da8c68cb40a80dc32f980ce310d63f
SHA512 1ff46fe1c209c1c7bd3e03301667f35117baf8d5bc0e699aa6465878e40903a22817c92b08a550e9cad886de3eee6048fdd5b18450d6dff17231bf58f617299f
SSDEEP 12288:OVgR8oWJiqkoHg9UeLTpoyPcLLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:NP5qkoHgyeLTpzvNyBo4kx929bL3Hnx
TLSH
T1B775AD1AA6A843E1C4B6D1388952E53AF9713C96433097DB17D17F2B3F72BE1993A700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.6MB

2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH d74a7ab8517e7ea97269d099407db825
SHA256 d29bb5b68976907100fd974c4278aefa69a18d1f99bdd3be9a5ae591659f5bbc
MD5 7142be36072b612033c269b9e0ba64cc
SHA1 aba9501d15da8c68cb40a80dc32f980ce310d63f
SHA512 1ff46fe1c209c1c7bd3e03301667f35117baf8d5bc0e699aa6465878e40903a22817c92b08a550e9cad886de3eee6048fdd5b18450d6dff17231bf58f617299f
SSDEEP 12288:OVgR8oWJiqkoHg9UeLTpoyPcLLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:NP5qkoHgyeLTpzvNyBo4kx929bL3Hnx
TLSH
T1B775AD1AA6A843E1C4B6D1388952E53AF9713C96433097DB17D17F2B3F72BE1993A700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

209592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\constructicon\builds\gfx\six\23.19\install\Neoma\InstallNeoma\IN_Apps\Bin\Win64a\B_rel\Setup.pdb

kernel32

GetLastError WaitForSingleObject GetExitCodeProcess CreateProcessW GetModuleFileNameW SetDefaultDllDirectories lstrlenW MultiByteToWideChar CreateFileW GetLogicalDriveStringsW HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetSystemInfo GetProcAddress LocalAlloc LocalFree WideCharToMultiByte GetUserDefaultUILanguage CloseHandle FindNextFileW SetEvent CreateEventA HeapSize WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage GetTimeZoneInformation HeapReAlloc SetStdHandle ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale OutputDebugStringW GetDriveTypeW FindClose GetModuleHandleW RaiseException VirtualProtect VirtualQuery FreeLibrary LoadLibraryExA FormatMessageA GetStringTypeW GetCurrentDirectoryW FindFirstFileExW GetFileAttributesExW GetFullPathNameW SetEndOfFile SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount CreateEventW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RtlUnwindEx SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetStdHandle WriteFile GetACP CompareStringW LCMapStringW GetLocaleInfoW RtlUnwind

imagehlp

ImageGetCertificateData ImageEnumerateCertificates

crypt32

CertGetNameStringW CertFreeCertificateContext CryptVerifyMessageSignature

Name

.text

Size

360KB

Virtual Size

359KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

568KB

Virtual Size

567KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_7142be36072b612033c269b9e0ba64cc_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

imagehlp

crypt32

generic