2026-08-21_4e6761dcb76fbb44dcd230570dd95340_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-08-21_4e6761dcb76fbb44dcd230570dd95340_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.7MB
Sample260821-e8dsksshpc
SHA256 fdf29c304a30c83f72562868ab05c9e96a40a414949e764ba67a0eac5dcbce35
MD5 4e6761dcb76fbb44dcd230570dd95340
SHA1 4b5af2686af7dc188d5f9574dddeef07d0a21b1f
SHA512 42aec40e28edc0ff4c94b241be8dd132a65e4e53801567723836ece9cc9633a7ce3712069707c759edc5d5eafc8278e4b34b635e65ae69e004453fe077360b8e
SSDEEP 12288:WVgUj9c9qkIo2M1eYhdqcBAiHfcywWs7:WHJcQhdYhdd+iE1W
TLSH
T147858C67A1593DF5E36628FDC8082E19A6F16CB4813D556B0ED8055D8E22A701CFFBC3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-21_4e6761dcb76fbb44dcd230570dd95340_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-08-21_4e6761dcb76fbb44dcd230570dd95340_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.7MB

2026-08-21_4e6761dcb76fbb44dcd230570dd95340_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 99d028cf165009e97fc686ce6c8d80fd
SHA256 fdf29c304a30c83f72562868ab05c9e96a40a414949e764ba67a0eac5dcbce35
MD5 4e6761dcb76fbb44dcd230570dd95340
SHA1 4b5af2686af7dc188d5f9574dddeef07d0a21b1f
SHA512 42aec40e28edc0ff4c94b241be8dd132a65e4e53801567723836ece9cc9633a7ce3712069707c759edc5d5eafc8278e4b34b635e65ae69e004453fe077360b8e
SSDEEP 12288:WVgUj9c9qkIo2M1eYhdqcBAiHfcywWs7:WHJcQhdYhdd+iE1W
TLSH
T147858C67A1593DF5E36628FDC8082E19A6F16CB4813D556B0ED8055D8E22A701CFFBC3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

8284

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\cloud\Desktop\Fuckery\Overshadow\Overshadow\Scatter\Brain\x64\Release\ScatterBrain.pdb

kernel32

GetTimeZoneInformation ExitProcess MultiByteToWideChar GetModuleFileNameW VirtualAllocExNuma VirtualAllocEx WriteProcessMemory VirtualProtect VirtualFreeEx WriteConsoleW HeapSize GetCurrentProcessId GetProcAddress GetModuleHandleW GetCurrentProcess GetComputerNameExW CloseHandle CreateFileW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer WideCharToMultiByte GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetFileType GetStdHandle WriteFile GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc CompareStringW LCMapStringW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetStdHandle

advapi32

GetUserNameW

CloseDriver DefDriverProc DisableSR DisableSRInternal DriverCallback DrvGetModuleHandle EnableSR EnableSREx EnableSRInternal GetDriverModuleHandle NotifyCallbackData OpenDriver PlaySound PlaySoundA PlaySoundW SRNewSystemId SRRemoveRestorePoint SRSetRestorePointA SRSetRestorePointInternal SRSetRestorePointW SendDriverMessage SetSRStateAfterSetup SysprepCleanup SysprepGeneralize WOW32DriverCallback WOW32ResolveMultiMediaHandle WOWAppExit aux32Message auxGetDevCapsA auxGetDevCapsW auxGetNumDevs auxGetVolume auxOutMessage auxSetVolume joy32Message joyConfigChanged joyGetDevCapsA joyGetDevCapsW joyGetNumDevs joyGetPos joyGetPosEx joyGetThreshold joyReleaseCapture joySetCapture joySetThreshold mci32Message mciDriverNotify mciDriverYield mciExecute mciFreeCommandResource mciGetCreatorTask mciGetDeviceIDA mciGetDeviceIDFromElementIDA mciGetDeviceIDFromElementIDW mciGetDeviceIDW mciGetDriverData mciGetErrorStringA mciGetErrorStringW mciGetYieldProc mciLoadCommandResource mciSendCommandA mciSendCommandW mciSendStringA mciSendStringW mciSetDriverData mciSetYieldProc mid32Message midiConnect midiDisconnect midiInAddBuffer midiInClose midiInGetDevCapsA midiInGetDevCapsW midiInGetErrorTextA midiInGetErrorTextW midiInGetID midiInGetNumDevs midiInMessage midiInOpen midiInPrepareHeader midiInReset midiInStart midiInStop midiInUnprepareHeader midiOutCacheDrumPatches midiOutCachePatches midiOutClose midiOutGetDevCapsA midiOutGetDevCapsW midiOutGetErrorTextA midiOutGetErrorTextW midiOutGetID midiOutGetNumDevs midiOutGetVolume midiOutLongMsg midiOutMessage midiOutOpen midiOutPrepareHeader midiOutReset midiOutSetVolume midiOutShortMsg midiOutUnprepareHeader midiStreamClose midiStreamOpen midiStreamOut midiStreamPause midiStreamPosition midiStreamProperty midiStreamRestart midiStreamStop mixerClose mixerGetControlDetailsA mixerGetControlDetailsW mixerGetDevCapsA mixerGetDevCapsW mixerGetID mixerGetLineControlsA mixerGetLineControlsW mixerGetLineInfoA mixerGetLineInfoW mixerGetNumDevs mixerMessage mixerOpen mixerSetControlDetails mmDrvInstall mmGetCurrentTask mmTaskBlock mmTaskCreate mmTaskSignal mmTaskYield mmioAdvance mmioAscend mmioClose mmioCreateChunk mmioDescend mmioFlush mmioGetInfo mmioInstallIOProcA mmioInstallIOProcW mmioOpenA mmioOpenW mmioRead mmioRenameA mmioRenameW mmioSeek mmioSendMessage mmioSetBuffer mmioSetInfo mmioStringToFOURCCA mmioStringToFOURCCW mmioWrite mmsystemGetVersion mod32Message mxd32Message sndPlaySoundA sndPlaySoundW tid32Message timeBeginPeriod timeEndPeriod timeGetDevCaps timeGetSystemTime timeGetTime timeKillEvent timeSetEvent waveInAddBuffer waveInClose waveInGetDevCapsA waveInGetDevCapsW waveInGetErrorTextA waveInGetErrorTextW waveInGetID waveInGetNumDevs waveInGetPosition waveInMessage waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader waveOutBreakLoop waveOutClose waveOutGetDevCapsA waveOutGetDevCapsW waveOutGetErrorTextA waveOutGetErrorTextW waveOutGetID waveOutGetNumDevs waveOutGetPitch waveOutGetPlaybackRate waveOutGetPosition waveOutGetVolume waveOutMessage waveOutOpen waveOutPause waveOutPrepareHeader waveOutReset waveOutRestart waveOutSetPitch waveOutSetPlaybackRate waveOutSetVolume waveOutUnprepareHeader waveOutWrite wid32Message wod32Message

Name

.text

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-21_4e6761dcb76fbb44dcd230570dd95340_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

advapi32

generic