2026-08-16_c0ff8cf08ec05d3a4f3b80ce8cefbad1_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-16_c0ff8cf08ec05d3a4f3b80ce8cefbad1_cobalt-strike_icedid_njrat_satacom_vidar
Size 166KB
Sample260816-vgr4wssyet
SHA256 fbf296bdf7e5fa8ba1dedec78804b901ce3308bdc8e5643c0eba5eed8456fc04
MD5 c0ff8cf08ec05d3a4f3b80ce8cefbad1
SHA1 a4a29b9fac5ec21e177b5655137d6ba57ec7fb29
SHA512 1a392f26f821d9d591ea64f4372bb0036115a3fe8e08553a62ce4d8cd7a5ef3befaeb77a032f3b69f67553c0e8d4d9dcec9854a8a839be8e2b6d04e229568c3f
SSDEEP 3072:1tJ2fCsQiuzYJ8WreWgxgjIFafthDCMfCvovHXrbl5STd:1wCszCYJ8OcgsafzB
TLSH
T1E2F37D4A73E510FDE1778139C9551A05F372782207209BAF07A047BA9F272E1AD3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-16_c0ff8cf08ec05d3a4f3b80ce8cefbad1_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-08-16_c0ff8cf08ec05d3a4f3b80ce8cefbad1_cobalt-strike_icedid_njrat_satacom_vidar

.exe 166KB

2026-08-16_c0ff8cf08ec05d3a4f3b80ce8cefbad1_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 30750ba96e4675bed41fdebb145fc411
SHA256 fbf296bdf7e5fa8ba1dedec78804b901ce3308bdc8e5643c0eba5eed8456fc04
MD5 c0ff8cf08ec05d3a4f3b80ce8cefbad1
SHA1 a4a29b9fac5ec21e177b5655137d6ba57ec7fb29
SHA512 1a392f26f821d9d591ea64f4372bb0036115a3fe8e08553a62ce4d8cd7a5ef3befaeb77a032f3b69f67553c0e8d4d9dcec9854a8a839be8e2b6d04e229568c3f
SSDEEP 3072:1tJ2fCsQiuzYJ8WreWgxgjIFafthDCMfCvovHXrbl5STd:1wCszCYJ8OcgsafzB
TLSH
T1E2F37D4A73E510FDE1778139C9551A05F372782207209BAF07A047BA9F272E1AD3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29812

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CloseClipboard GetClipboardSequenceNumber SetClipboardData GetClipboardData EmptyClipboard OpenClipboard

advapi32

RegOpenKeyExA RegCloseKey GetUserNameA RegSetValueExA

winhttp

WinHttpCloseHandle WinHttpOpen WinHttpQueryDataAvailable WinHttpReadData WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpConnect

shell32

SHGetFolderPathA

kernel32

GetConsoleOutputCP CreateFileW WriteConsoleW GetConsoleMode FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetStringTypeW SetStdHandle GetProcessHeap SetFileAttributesA CloseHandle GetLastError CreateMutexA Sleep GetCurrentProcessId CreateThread GetTickCount GetModuleFileNameA GlobalAlloc GlobalUnlock GlobalLock CopyFileA GetComputerNameA MultiByteToWideChar WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW CompareStringW LCMapStringW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-16_c0ff8cf08ec05d3a4f3b80ce8cefbad1_cobalt-strike_icedid_njrat_satacom_vidar

user32

advapi32

winhttp

shell32

kernel32

generic