2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar

General

Target
2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 1.8MB
Sample260824-rrbccazajd
SHA256 b8b2b18c27fb9d75d2a2b972fc36ca693c6106e261b2dcaf4e9a758bd0cf7ea5
MD5 33525a0336020d69c6ef58ea85fc62f7
SHA1 64fc3d15480faea2b9a0d323d72d263d71446cce
SHA512 f69299070277f2275de836e50769c28f790aa244fc4a7ac0ee417f0e3a56bf82ad519d6e1fd3e2216087246db0c6f0bdd4061d6567c6ccd850d60a4c18c7055e
SSDEEP 12288:tYMri1GOJdlrqJ0tclYYZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+x:tYMrE8Hd3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T16695E015F7A804E8F5B792388A729902EB767C550730C5DF13A486667F33AE09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 1.8MB

2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH d59a940a3a699c745e66d2474a025233
SHA256 b8b2b18c27fb9d75d2a2b972fc36ca693c6106e261b2dcaf4e9a758bd0cf7ea5
MD5 33525a0336020d69c6ef58ea85fc62f7
SHA1 64fc3d15480faea2b9a0d323d72d263d71446cce
SHA512 f69299070277f2275de836e50769c28f790aa244fc4a7ac0ee417f0e3a56bf82ad519d6e1fd3e2216087246db0c6f0bdd4061d6567c6ccd850d60a4c18c7055e
SSDEEP 12288:tYMri1GOJdlrqJ0tclYYZ3sieQc52oIBlEhw1y58cergwIgnbhy4kg+w5fojnW+x:tYMrE8Hd3KnAoIBlEq1tIgAWz5foj3Z
TLSH
T16695E015F7A804E8F5B792388A729902EB767C550730C5DF13A486667F33AE09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

177256

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Files\Repos\PresentMon\build\Release\PresentMon-2.3.1-x64.pdb

kernel32

GetConsoleScreenBufferInfo GetStdHandle GetFileSizeEx SetConsoleTextAttribute WriteFile SetConsoleWindowInfo GetConsoleMode FillConsoleOutputCharacterW ReadConsoleOutputW ScrollConsoleScreenBufferW GetFileType SetConsoleCursorPosition WriteConsoleOutputCharacterW SetThreadDescription SetThreadPriority GetCurrentThread SetConsoleCtrlHandler LoadLibraryExA Sleep EnterCriticalSection LeaveCriticalSection InitializeCriticalSection OpenProcess CloseHandle DeleteCriticalSection QueryFullProcessImageNameW QueryPerformanceCounter GetExitCodeProcess GetCurrentProcess GetModuleFileNameW WaitForSingleObject GetLastError GetProcAddress FreeLibrary RaiseException GetSystemInfo VirtualProtect VirtualQuery GetModuleHandleW FileTimeToSystemTime FileTimeToLocalFileTime SystemTimeToFileTime SystemTimeToTzSpecificLocalTime GetSystemTimeAsFileTime CreateEventW SetEvent GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive InitializeCriticalSectionEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead SetEndOfFile RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW SetStdHandle GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP HeapReAlloc HeapSize SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetStringTypeW ReadFile ReadConsoleW CreateFileW WriteConsoleW

Name

.text

Size

287KB

Virtual Size

287KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.4MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_33525a0336020d69c6ef58ea85fc62f7_cobalt-strike_icedid_njrat_satacom_stealc_vidar

kernel32

generic