2026-08-20_eebe8536095f065d878d2018dbe230ec_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_eebe8536095f065d878d2018dbe230ec_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 522KB
Sample260820-dhx8vsdq21
SHA256 6c559b662f30f917885ebeae7448a9bc5f43226f1c05e55c8ff6c48f57a47598
MD5 eebe8536095f065d878d2018dbe230ec
SHA1 25f53fee8d0671cd7b980225364b6be0909f2d49
SHA512 1ff04be86e539fe0ec4dbfac53e9e25d059eb7c6e386496d865e2a027af27a981f49d45525f52fae7a5ffd337427507afdcf6afe3c307d8a338f81813fa34549
SSDEEP 6144:w1jm9vmbdu8yKfjcCiFtG06Mc9/NCLYa/axNyTdIcy1WLY2TLmtuohWMav9Rfsgi:wRmdAoChBT9za/LTG2LfoK1
TLSH
T1CDB45A5A626943FDE07BA07CD9475E42F638744603B58AEF039009B71E532E1AF7E760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_eebe8536095f065d878d2018dbe230ec_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-08-20_eebe8536095f065d878d2018dbe230ec_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 522KB

2026-08-20_eebe8536095f065d878d2018dbe230ec_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH a896523cbeaa29c3b20d0d3a81020dff
SHA256 6c559b662f30f917885ebeae7448a9bc5f43226f1c05e55c8ff6c48f57a47598
MD5 eebe8536095f065d878d2018dbe230ec
SHA1 25f53fee8d0671cd7b980225364b6be0909f2d49
SHA512 1ff04be86e539fe0ec4dbfac53e9e25d059eb7c6e386496d865e2a027af27a981f49d45525f52fae7a5ffd337427507afdcf6afe3c307d8a338f81813fa34549
SSDEEP 6144:w1jm9vmbdu8yKfjcCiFtG06Mc9/NCLYa/axNyTdIcy1WLY2TLmtuohWMav9Rfsgi:wRmdAoChBT9za/LTG2LfoK1
TLSH
T1CDB45A5A626943FDE07BA07CD9475E42F638744603B58AEF039009B71E532E1AF7E760
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

212396

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Wow64RevertWow64FsRedirection GetLastError GetFileAttributesA CreateFileA CloseHandle GetSystemInfo CreateThread GetProcAddress GetTempPathA CreateProcessA CreateDirectoryA WriteConsoleW SetEndOfFile HeapSize GetProcessHeap SetEnvironmentVariableW Sleep SetCurrentDirectoryA GetModuleHandleA GetComputerNameExW WaitForSingleObject GetVersionExW CreateMutexA FindClose PeekNamedPipe CreatePipe Wow64DisableWow64FsRedirection WriteFile FindNextFileW GetFullPathNameW FindFirstFileExW SetHandleInformation GetModuleFileNameA RemoveDirectoryA ReadFile FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation HeapReAlloc ReadConsoleW SetStdHandle GetCurrentDirectoryW DeleteFileW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA GetStdHandle GetModuleFileNameW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType GetFileInformationByHandle GetDriveTypeW CreateFileW ExitProcess RtlPcToFileHeader RaiseException GetCurrentThreadId IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW InitOnceComplete InitOnceBeginInitialize InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection WaitForSingleObjectEx QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind

user32

GetDC MessageBoxA ReleaseDC GetSystemMetrics

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC DeleteObject BitBlt

advapi32

RegCloseKey RegQueryInfoKeyW RegGetValueA RegQueryValueExA GetSidSubAuthorityCount GetSidSubAuthority GetUserNameA LookupAccountNameA RegSetValueExA RegOpenKeyExA RegEnumValueA GetSidIdentifierAuthority

shell32

ShellExecuteA SHGetFolderPathA

ole32

CoUninitialize CoCreateInstance CoInitialize

wininet

HttpOpenRequestA InternetWriteFile InternetOpenUrlA InternetOpenW HttpEndRequestW HttpAddRequestHeadersA HttpSendRequestExA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA InternetReadFile

gdiplus

GdiplusStartup GdipSaveImageToFile GdipGetImageEncodersSize GdiplusShutdown GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipDisposeImage

ws2_32

closesocket inet_pton getaddrinfo WSAStartup send socket connect recv htons freeaddrinfo

Name

.text

Size

383KB

Virtual Size

383KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

105KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_eebe8536095f065d878d2018dbe230ec_cobalt-strike_icedid_njrat_satacom_stealc_vidar

kernel32

user32

gdi32

advapi32

shell32

ole32

wininet

gdiplus

ws2_32

generic