2026-08-14_0624fbfa7618628e1ede80fcc3c36b25_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_0624fbfa7618628e1ede80fcc3c36b25_cobalt-strike_icedid_njrat_satacom_vidar
Size 5.8MB
Sample260814-m2sl6aak2w
SHA256 018c464676b4a71be83bc073f482e94a4850e9c24abe4c4ed1285258ca95a21e
MD5 0624fbfa7618628e1ede80fcc3c36b25
SHA1 c9723d207f8b63a6fdbc1f6bdd4e9bd7c2dc8bea
SHA512 13ff630c6016aa8f768f5f57865709a391b73ab3dd37afdc140871c2a6a9b6a47d9aa4e405ce45c5d784fca45be94d09c75ef900a3ca41fa2999e4d967037279
SSDEEP 49152:hekOzkIPJI1P78Y3wrzLiUrf5iGarGgn2E+vYK2KibQmy0e9RF5+yl:heEqIhwPRfAhh2/xu/yYU
TLSH
T1B656EBF330D2A7EDC867D67E8303FD7F8B4F70368517A49360A892619A16C497A59F08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

themida

Malware Config

Signatures

Detects executables packed with Themida 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_Themida

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_0624fbfa7618628e1ede80fcc3c36b25_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-08-14_0624fbfa7618628e1ede80fcc3c36b25_cobalt-strike_icedid_njrat_satacom_vidar

.exe 5.8MB

2026-08-14_0624fbfa7618628e1ede80fcc3c36b25_cobalt-strike_icedid_njrat_satacom_vidar

SHA256 018c464676b4a71be83bc073f482e94a4850e9c24abe4c4ed1285258ca95a21e
MD5 0624fbfa7618628e1ede80fcc3c36b25
SHA1 c9723d207f8b63a6fdbc1f6bdd4e9bd7c2dc8bea
SHA512 13ff630c6016aa8f768f5f57865709a391b73ab3dd37afdc140871c2a6a9b6a47d9aa4e405ce45c5d784fca45be94d09c75ef900a3ca41fa2999e4d967037279
SSDEEP 49152:hekOzkIPJI1P78Y3wrzLiUrf5iGarGgn2E+vYK2KibQmy0e9RF5+yl:heEqIhwPRfAhh2/xu/yYU
TLSH
T1B656EBF330D2A7EDC867D67E8303FD7F8B4F70368517A49360A892619A16C497A59F08
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with Themida
Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3541409

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_0624fbfa7618628e1ede80fcc3c36b25_cobalt-strike_icedid_njrat_satacom_vidar

generic