2026-08-19_aaf3b50bc7eb3089534211bc4bf63717_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-19_aaf3b50bc7eb3089534211bc4bf63717_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.4MB
Sample260819-162bravbnd
SHA256 1b7c9a9d5ff785eea60a9c40442679f95e1aad7b4b78ea4a6960a66d575392f6
MD5 aaf3b50bc7eb3089534211bc4bf63717
SHA1 c906a70116760161eb55503e2de9edc22818fad8
SHA512 a5481458ba5c8a9179ba861a19e6e14c26d599c422335a0de9154cfa85e7b9645159816ef296c1b4a25268bebcb8367d4cc92eb30ee56bfbf318a2c84ca81bbb
SSDEEP 24576:if6q5YswcR+OYigwgCqeMbHSuhnpEuyoNv3AmnpedRyFzz:if6q6swcEOYbCqeMjSu3HWA9FX
TLSH
T189659C03F7C940D4D06ED175869A9566E9B2BC020B70BADF0590BA5B2F37AE05F3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-19_aaf3b50bc7eb3089534211bc4bf63717_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-08-19_aaf3b50bc7eb3089534211bc4bf63717_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.4MB

2026-08-19_aaf3b50bc7eb3089534211bc4bf63717_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 3ad5fd0e710e6da9aa93f6197f31430c
SHA256 1b7c9a9d5ff785eea60a9c40442679f95e1aad7b4b78ea4a6960a66d575392f6
MD5 aaf3b50bc7eb3089534211bc4bf63717
SHA1 c906a70116760161eb55503e2de9edc22818fad8
SHA512 a5481458ba5c8a9179ba861a19e6e14c26d599c422335a0de9154cfa85e7b9645159816ef296c1b4a25268bebcb8367d4cc92eb30ee56bfbf318a2c84ca81bbb
SSDEEP 24576:if6q5YswcR+OYigwgCqeMbHSuhnpEuyoNv3AmnpedRyFzz:if6q6swcEOYbCqeMjSu3HWA9FX
TLSH
T189659C03F7C940D4D06ED175869A9566E9B2BC020B70BADF0590BA5B2F37AE05F3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1381888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CreateProcessAsUserW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CompareStringW CreateEventW CreateFileW CreateProcessW CreateThread DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadPriority GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetThreadInformation SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnregisterWaitEx UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

winmm

timeGetTime

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

user32

AllowSetForegroundWindow GetActiveWindow

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

ole32

CoRevokeInitializeSpy CoTaskMemFree CoUninitialize

ntdll

NtClose NtOpenKeyEx NtQueryValueKey RtlFormatCurrentUserKeyPath RtlFreeUnicodeString RtlInitUnicodeString

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize

Name

.text

Size

967KB

Virtual Size

967KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

58KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

140B

Characteristics

Name

.tls

Size

512B

Virtual Size

449B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

LZMADEC

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

137KB

Virtual Size

329KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-19_aaf3b50bc7eb3089534211bc4bf63717_cobalt-strike_icedid_njrat_satacom_vidar

advapi32

kernel32

winmm

userenv

user32

shell32

ole32

ntdll

api-ms-win-core-winrt-l1-1-0

generic