2026-08-20_2c337b02206e1ef8b721f0d7c303761e_cobalt-strike_icedid_satacom_vidar

General

Target
2026-08-20_2c337b02206e1ef8b721f0d7c303761e_cobalt-strike_icedid_satacom_vidar
Size 100KB
Sample260820-s85syszgrg
SHA256 4fb1aef4c32c9d2e694798fc695b2d81b9ec8a2978c932a4f6f75690e5252ea8
MD5 2c337b02206e1ef8b721f0d7c303761e
SHA1 c75a611aeb21b5bda1421093daa65141116dc863
SHA512 a804d26b98de7847a25fa2b90fd937996dbc83b0df8366d3319273187fb8d0ed9d4737914d7b5a135970d8cc885d470411e5e12fdb095f05c3f8d568652a0ba5
SSDEEP 1536:cOUIcNQDgbcKBiNSS0naCjXFq2SfbJ64MIIupJj4tzeJHQsWf3Nd09dlxzr:DUDogbKNIVF56gpIIupIee3nMvzr
TLSH
T163A36A9B73A530E8E6768238C8650A05EB77B8311621DF6F03A446861F273D19D3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_2c337b02206e1ef8b721f0d7c303761e_cobalt-strike_icedid_satacom_vidar

File Explorer

2026-08-20_2c337b02206e1ef8b721f0d7c303761e_cobalt-strike_icedid_satacom_vidar

.exe 100KB

2026-08-20_2c337b02206e1ef8b721f0d7c303761e_cobalt-strike_icedid_satacom_vidar

IMPHASH 4eb62e73a13e6121dcd18b686e2d4266
SHA256 4fb1aef4c32c9d2e694798fc695b2d81b9ec8a2978c932a4f6f75690e5252ea8
MD5 2c337b02206e1ef8b721f0d7c303761e
SHA1 c75a611aeb21b5bda1421093daa65141116dc863
SHA512 a804d26b98de7847a25fa2b90fd937996dbc83b0df8366d3319273187fb8d0ed9d4737914d7b5a135970d8cc885d470411e5e12fdb095f05c3f8d568652a0ba5
SSDEEP 1536:cOUIcNQDgbcKBiNSS0naCjXFq2SfbJ64MIIupJj4tzeJHQsWf3Nd09dlxzr:DUDogbKNIVF56gpIIupIee3nMvzr
TLSH
T163A36A9B73A530E8E6768238C8650A05EB77B8311621DF6F03A446861F273D19D3EFA1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mpr

WNetCloseEnum WNetEnumResourceA WNetOpenEnumA

kernel32

TlsSetValue WriteConsoleW CreateFileW CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetDriveTypeA GetFileAttributesA GetFileSize ReadFile WriteFile GetVolumeInformationA CloseHandle HeapAlloc HeapFree GetProcessHeap GetModuleFileNameA lstrcmpiA lstrcpynA lstrcatA GetLogicalDriveStringsA MoveFileA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW SetFilePointerEx RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException GetStdHandle GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW LCMapStringW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_2c337b02206e1ef8b721f0d7c303761e_cobalt-strike_icedid_satacom_vidar

mpr

kernel32

generic