2026-08-24_7a8be4b26b51f070ae8f67db0b1d878c_cobalt-strike_icedid_satacom_vidar

General

Target
2026-08-24_7a8be4b26b51f070ae8f67db0b1d878c_cobalt-strike_icedid_satacom_vidar
Size 9.9MB
Sample260825-lva8vsgp2x
SHA256 f1654c251df19ab1fab33e2e1768d9b1630741f5f11d2503c75f33bf67a49ec2
MD5 7a8be4b26b51f070ae8f67db0b1d878c
SHA1 45017efcbab5a71ca4b265720761f91254dc5f62
SHA512 6348e8c35a2564b52912c068e8e51e7c206cffb32f189436bd94e1fe87d73954ae5e64d1eabd9c29959c28e6cceb069628f7379f7e4e854e22847be3072ad28e
SSDEEP 196608:IWxD3TLsQgsGCxy3TLsQgsf8DArbtxUtPz3Smj7d9+tN6kLVq:31ssFEssksrbtatf9WN62V
TLSH
T174A6337736A518E8FB4C8270D7344D667770EC8911738F3E22A640377E3A9A69F86874
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-24_7a8be4b26b51f070ae8f67db0b1d878c_cobalt-strike_icedid_satacom_vidar

File Explorer

2026-08-24_7a8be4b26b51f070ae8f67db0b1d878c_cobalt-strike_icedid_satacom_vidar

.exe 9.9MB

2026-08-24_7a8be4b26b51f070ae8f67db0b1d878c_cobalt-strike_icedid_satacom_vidar

IMPHASH 6b46d14e506e96f6104eaca4ffd6f8c4
SHA256 f1654c251df19ab1fab33e2e1768d9b1630741f5f11d2503c75f33bf67a49ec2
MD5 7a8be4b26b51f070ae8f67db0b1d878c
SHA1 45017efcbab5a71ca4b265720761f91254dc5f62
SHA512 6348e8c35a2564b52912c068e8e51e7c206cffb32f189436bd94e1fe87d73954ae5e64d1eabd9c29959c28e6cceb069628f7379f7e4e854e22847be3072ad28e
SSDEEP 196608:IWxD3TLsQgsGCxy3TLsQgsf8DArbtxUtPz3Smj7d9+tN6kLVq:31ssFEssksrbtatf9WN62V
TLSH
T174A6337736A518E8FB4C8270D7344D667770EC8911738F3E22A640377E3A9A69F86874
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ShellExecuteExW

kernel32

FreeLibrary WriteConsoleW GetCurrentDirectoryW CreateFileW SetFileAttributesW WriteFile GetTempPathW CloseHandle HeapAlloc HeapFree GetProcessHeap LoadResource LockResource SizeofResource FindResourceW lstrcpyW lstrcatW lstrlenW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcAddress LoadLibraryExW RaiseException GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW LCMapStringW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Name

.text

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

9.8MB

Virtual Size

9.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-24_7a8be4b26b51f070ae8f67db0b1d878c_cobalt-strike_icedid_satacom_vidar

shell32

kernel32

generic