2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar

General

Target
2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar
Size 2.7MB
Sample260812-tk28la1amb
SHA256 7f84255996a11a4034e80017b05fda810f2948e51cde543865820e6cebac1f5b
MD5 0c3d8f0408cb0e947211b3aecfe25e4a
SHA1 d3b8f2f3f029868ff46dba9461da1a7c73c726a4
SHA512 1ae679ac4a73cf5c9d9b77f90e4f8f50f2bc8dc37563ed50c384f26115cd8cb85e30f16bc92865fc7a42aa71cfaad555a8325005b2b003dfe11b30d6f6006e7e
SSDEEP 49152:yxePOqbEc9zkUQIz+r3OvjgA0Xb8hNvVVdD3vOMmDDuAMBg65d:NEykvXivfuuAszd
TLSH
T1FDD5AD43F25601E9C07BD034C99A9717F774B80903209AFB87E499656F53AE0AF7B392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar

File Explorer

2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar

.exe 2.7MB

2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar

IMPHASH f998e897475a1c651fad61f0f2b01691
SHA256 7f84255996a11a4034e80017b05fda810f2948e51cde543865820e6cebac1f5b
MD5 0c3d8f0408cb0e947211b3aecfe25e4a
SHA1 d3b8f2f3f029868ff46dba9461da1a7c73c726a4
SHA512 1ae679ac4a73cf5c9d9b77f90e4f8f50f2bc8dc37563ed50c384f26115cd8cb85e30f16bc92865fc7a42aa71cfaad555a8325005b2b003dfe11b30d6f6006e7e
SSDEEP 49152:yxePOqbEc9zkUQIz+r3OvjgA0Xb8hNvVVdD3vOMmDDuAMBg65d:NEykvXivfuuAszd
TLSH
T1FDD5AD43F25601E9C07BD034C99A9717F774B80903209AFB87E499656F53AE0AF7B392
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

3108352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetConsoleOutputCP QueryPerformanceCounter QueryPerformanceFrequency Sleep GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WakeConditionVariable WakeAllConditionVariable WaitForSingleObject CreateFileW GetFileSizeEx CloseHandle MapViewOfFile UnmapViewOfFile CreateFileMappingA MultiByteToWideChar SetEndOfFile WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW WideCharToMultiByte InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW ReadFile CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapReAlloc ReadConsoleW SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

830KB

Virtual Size

829KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

367KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

41KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_0c3d8f0408cb0e947211b3aecfe25e4a_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar

kernel32

generic