2026-08-12_cf482f9687e9b38a5311f813f7a109d2_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-12_cf482f9687e9b38a5311f813f7a109d2_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 1.1MB
Sample260812-lrmsgsej71
SHA256 bebf9f687128e8e82c6c447ead8eb1b7ae9eb2bb1584679312ff25a49f3c4a79
MD5 cf482f9687e9b38a5311f813f7a109d2
SHA1 144132c9ca9b9368756e9d8ba0d8d4b7c3e4bf38
SHA512 672945d035e7e4914f0333c5b0d755a3867d1a0143c410c987309b207bca5ca54355da4da46d66c352da6d00a8b5c3e98adfa166a44cc51bc465886d94287b07
SSDEEP 24576:oQquCVVgbxbOUAPY0OwHIsTQ75n4V+O93l0fZKb:BGQhf0Odn6+O93+x
TLSH
T1E835AE06A7A410FCE1B7D178CA966607E772B85607309ACF1394256A3F336E05F7EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_cf482f9687e9b38a5311f813f7a109d2_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-08-12_cf482f9687e9b38a5311f813f7a109d2_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 1.1MB

2026-08-12_cf482f9687e9b38a5311f813f7a109d2_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH 3dbd94119ae9fffe23e7393fb002a249
SHA256 bebf9f687128e8e82c6c447ead8eb1b7ae9eb2bb1584679312ff25a49f3c4a79
MD5 cf482f9687e9b38a5311f813f7a109d2
SHA1 144132c9ca9b9368756e9d8ba0d8d4b7c3e4bf38
SHA512 672945d035e7e4914f0333c5b0d755a3867d1a0143c410c987309b207bca5ca54355da4da46d66c352da6d00a8b5c3e98adfa166a44cc51bc465886d94287b07
SSDEEP 24576:oQquCVVgbxbOUAPY0OwHIsTQ75n4V+O93l0fZKb:BGQhf0Odn6+O93+x
TLSH
T1E835AE06A7A410FCE1B7D178CA966607E772B85607309ACF1394256A3F336E05F7EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

431552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpQueryDataAvailable

advapi32

LookupPrivilegeValueA RegCloseKey GetCurrentHwProfileA RegQueryValueExA AllocateAndInitializeSid OpenProcessToken FreeSid RegOpenKeyExA CheckTokenMembership AdjustTokenPrivileges

crypt32

CryptUnprotectData CryptProtectData CryptBinaryToStringA

bcrypt

BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptSetProperty

user32

GetKeyState LoadCursorA GetCapture ClientToScreen SetCapture GetCursorPos ReleaseCapture SetCursorPos GetGUIThreadInfo OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData SetCursor GetWindowThreadProcessId GetWindow DispatchMessageA DestroyWindow GetDC IsWindowVisible SetWindowRgn PostMessageA ScreenToClient GetSystemMetrics GetClassNameA ShowWindow SetWindowsHookExA GetWindowTextA MessageBoxA UnhookWindowsHookEx EnumWindows DefWindowProcA PostThreadMessageA CreateWindowExA TranslateMessage GetClientRect PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow ReleaseDC

shell32

SHGetFolderPathA ShellExecuteA SHGetFolderPathW ShellExecuteW

d3d11

D3D11CreateDeviceAndSwapChain

gdi32

DeleteDC CreateRoundRectRgn CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt DeleteObject

gdiplus

GdipCreateBitmapFromScan0 GdipSaveImageToStream GdipGetImageWidth GdipDeleteGraphics GdiplusStartup GdipGetImageHeight GdipGetImageEncoders GdipCloneImage GdipAlloc GdipDrawImageRectI GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdipSetInterpolationMode GdipCloneBitmapAreaI GdipFree GdipGetImageGraphicsContext GdipDisposeImage

ole32

CoInitializeEx CreateStreamOnHGlobal CoCreateInstance CoUninitialize

ntdll

RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RtlCaptureContext RtlVirtualUnwind RtlUnwind

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

kernel32

SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW FlsGetValue FlsAlloc RaiseException GetModuleFileNameW WriteConsoleW IsProcessorFeaturePresent HeapAlloc UnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo WakeAllConditionVariable LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection SetStdHandle SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimePreciseAsFileTime QueryPerformanceCounter QueryPerformanceFrequency GlobalUnlock GlobalLock GlobalFree GlobalAlloc GetCurrentProcessId GetCurrentThreadId DeviceIoControl GetCommandLineA FindNextFileW HeapSize SetEndOfFile FlsSetValue FlsFree CreateThread ExitThread FreeLibraryAndExitThread FindFirstFileExW HeapReAlloc GetOEMCP GetACP IsValidCodePage OutputDebugStringW ReadConsoleW GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileAttributesExW CreateProcessW GetExitCodeProcess EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW HeapFree GetTimeZoneInformation CreateFileW GetModuleHandleExW ExitProcess GetProcessHeap GetStdHandle GetStringTypeW CreateDirectoryW ReadFile GetModuleFileNameA GetFileSizeEx WriteProcessMemory FindFirstFileA VirtualProtect GetCurrentProcess WriteFile TerminateProcess LoadLibraryExA FindNextFileA SetFilePointer FindClose WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetExitCodeThread Sleep GetTempPathA GetTickCount64 GetFileAttributesA Process32NextW CreateFileA GetCurrentThread LoadLibraryA DeleteFileA DeleteFileW Process32FirstW CloseHandle WritePrivateProfileStringA GetThreadContext GetProcAddress VirtualAllocEx LocalFree FreeLibrary WideCharToMultiByte CreateRemoteThread CreateProcessA CreateDirectoryA VirtualFreeEx IsDebuggerPresent CheckRemoteDebuggerPresent FlushFileBuffers SetLastError VirtualFree VirtualAlloc GetTempPathW GetFileAttributesW GetLastError LoadLibraryW GetWindowsDirectoryW Beep GetFileType

Name

.text

Size

633KB

Virtual Size

633KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

193KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

278KB

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_cf482f9687e9b38a5311f813f7a109d2_cobalt-strike_icedid_njrat_satacom_stealc_vidar

winhttp

advapi32

crypt32

bcrypt

user32

shell32

d3d11

gdi32

gdiplus

ole32

ntdll

imm32

d3dcompiler_47

kernel32

generic