2026-08-14_3ec5e5899bc176ffe2506c5c6ef8d854_cobalt-strike_icedid_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_3ec5e5899bc176ffe2506c5c6ef8d854_cobalt-strike_icedid_satacom_stealc_vidar
Size 725KB
Sample260814-th5wpsel4s
SHA256 9f7cafd726f3b4ba3c7a2c59717486da26a067a49427c06a0101281778e49777
MD5 3ec5e5899bc176ffe2506c5c6ef8d854
SHA1 0450a63dbc6bc838b6247ddda893d2914d82ca6f
SHA512 bcae468fabd95c3b8e30a87d7a1cd47472917cd52f51a700721615784a033ad4d376b39c389082c6b2d5159b80a11ec9659c9d55f2f8b61fbe33ddaf4f7ca430
SSDEEP 12288:8cht97QA2DB+vjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:8cHroBY73c82R7VpWBPnmyjHBldthWF4
TLSH
T1F7F4010B33A830F9E5A6C135C9524A02F3B1FCB607509B9F13A8577A2F37991AD1EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_3ec5e5899bc176ffe2506c5c6ef8d854_cobalt-strike_icedid_satacom_stealc_vidar

File Explorer

2026-08-14_3ec5e5899bc176ffe2506c5c6ef8d854_cobalt-strike_icedid_satacom_stealc_vidar

.exe 725KB

2026-08-14_3ec5e5899bc176ffe2506c5c6ef8d854_cobalt-strike_icedid_satacom_stealc_vidar

IMPHASH 4f32214340f08cb2ab89522936793048
SHA256 9f7cafd726f3b4ba3c7a2c59717486da26a067a49427c06a0101281778e49777
MD5 3ec5e5899bc176ffe2506c5c6ef8d854
SHA1 0450a63dbc6bc838b6247ddda893d2914d82ca6f
SHA512 bcae468fabd95c3b8e30a87d7a1cd47472917cd52f51a700721615784a033ad4d376b39c389082c6b2d5159b80a11ec9659c9d55f2f8b61fbe33ddaf4f7ca430
SSDEEP 12288:8cht97QA2DB+vjvn3cvE2R7VL9Wxg07bnmyjCuBldthTCFyWUiMWZLyoFF:8cHroBY73c82R7VpWBPnmyjHBldthWF4
TLSH
T1F7F4010B33A830F9E5A6C135C9524A02F3B1FCB607509B9F13A8577A2F37991AD1EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

BraveUpdateComRegisterShell64_unsigned.pdb

advapi32

RegCloseKey RegOverridePredefKey RegOpenKeyExW RegQueryValueExW

kernel32

FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FindResourceExW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException DecodePointer GetCommandLineW GetModuleHandleExW GetModuleFileNameW GetEnvironmentVariableW CloseHandle GetCurrentProcessId VirtualQuery LocalFree SetLastError FindNextFileW GetCurrentProcess FindClose GetFileAttributesExW LoadLibraryW FreeLibrary lstrcmpiW GetTickCount LoadLibraryExW TerminateProcess Sleep lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile CreateFileW GetSystemTimeAsFileTime FlushFileBuffers GetPrivateProfileIntW OutputDebugStringA GetCurrentThreadId OutputDebugStringW TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExitProcess IsDebuggerPresent GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx RtlPcToFileHeader TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

wsprintfW MessageBoxW EmptyClipboard CloseClipboard OpenClipboard SetClipboardData CharLowerBuffW

shlwapi

PathStripPathW PathRemoveExtensionW PathRemoveFileSpecW PathAppendW

shell32

CommandLineToArgvW

Name

.text

Size

83KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_3ec5e5899bc176ffe2506c5c6ef8d854_cobalt-strike_icedid_satacom_stealc_vidar

advapi32

kernel32

user32

shlwapi

shell32

generic