2026-08-25_66ec20879b93de0ace52627744dacad2_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_66ec20879b93de0ace52627744dacad2_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 1.6MB
Sample260826-2w6n6axepe
SHA256 b8e066f1d8dd7c0ec66db23bd70381f66727f87decd9e7ae86489f63f775da35
MD5 66ec20879b93de0ace52627744dacad2
SHA1 a2c42832dd78647baa135c03013ea40c03dd17b3
SHA512 1522f6c28bec3e4dc27dbffbffa72febd26af7c9dd523501ba78c0b808a85ca26de036be56959c4241793125da4b8ccfd94fac41cafb10577450e327e38c89bc
SSDEEP 49152:DXf6hs9L7hV3LA5PgPZ4atdJLNiXicJFFRGNzj3:N7nLA5k7wRGpj3
TLSH
T165859D45AE9BC5E9D07BA13FCA564D02D5BEF606031396CB0B904A753F136E34D3A3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_66ec20879b93de0ace52627744dacad2_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-08-25_66ec20879b93de0ace52627744dacad2_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 1.6MB

2026-08-25_66ec20879b93de0ace52627744dacad2_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH d58a7367651c987333c653a633c4e885
SHA256 b8e066f1d8dd7c0ec66db23bd70381f66727f87decd9e7ae86489f63f775da35
MD5 66ec20879b93de0ace52627744dacad2
SHA1 a2c42832dd78647baa135c03013ea40c03dd17b3
SHA512 1522f6c28bec3e4dc27dbffbffa72febd26af7c9dd523501ba78c0b808a85ca26de036be56959c4241793125da4b8ccfd94fac41cafb10577450e327e38c89bc
SSDEEP 49152:DXf6hs9L7hV3LA5PgPZ4atdJLNiXicJFFRGNzj3:N7nLA5k7wRGpj3
TLSH
T165859D45AE9BC5E9D07BA13FCA564D02D5BEF606031396CB0B904A753F136E34D3A3A2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

348768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\gcomp\rel\src\NvContainer\_out\x86_64\release\container\NvContainer.pdb

shlwapi

PathIsRelativeW

kernel32

ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW OutputDebugStringA Sleep GetCurrentThreadId ProcessIdToSessionId GetSystemTime GetSystemTimeAsFileTime CreateTimerQueueTimer DeleteTimerQueueTimer GetModuleFileNameW GetModuleHandleExW MoveFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW FreeLibrary GetProcAddress FindCloseChangeNotification FindFirstChangeNotificationW FindNextChangeNotification GetCurrentDirectoryW SetLastError GetErrorMode SetErrorMode LoadLibraryExW VerSetConditionMask CreateFileW GetFullPathNameW LocalFree CreateProcessA CreateProcessW GetSystemDirectoryW GetModuleFileNameA lstrcmpA VerifyVersionInfoW FileTimeToSystemTime RemoveDirectoryW DeviceIoControl MultiByteToWideChar WideCharToMultiByte VirtualQuery VirtualProtect GetSystemInfo WriteConsoleW HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetStringTypeW HeapReAlloc ReadConsoleW ReadFile SetStdHandle GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers LocalAlloc GetCurrentProcessId GetLastError RemoveVectoredContinueHandler AddVectoredContinueHandler RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetUnhandledExceptionFilter RtlCaptureStackBackTrace RtlUnwind GetModuleHandleW OpenProcess CreateThread WaitForMultipleObjects OpenEventW CreateEventW WaitForSingleObject SetEvent CloseHandle GetCurrentProcess GetProcessTimes SetDefaultDllDirectories LoadLibraryExA OutputDebugStringW FormatMessageA SetCurrentDirectoryW FindFirstFileExW GetDiskFreeSpaceExW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW SetEndOfFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime GetTempPathW AreFileApisANSI CreateDirectoryExW CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedPushEntrySList InterlockedFlushSList RtlPcToFileHeader RaiseException RtlUnwindEx EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetFileType GetCPInfo GetStdHandle WriteFile GetCurrentThread HeapAlloc HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleCtrlHandler

user32

LoadStringW PostThreadMessageW PeekMessageW GetMessageW ShutdownBlockReasonDestroy ShutdownBlockReasonCreate SetWindowLongPtrW GetWindowLongPtrW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW PostMessageW DispatchMessageW TranslateMessage

shell32

SHGetKnownFolderPath CommandLineToArgvW

ole32

CoTaskMemFree

advapi32

OpenServiceW RegSetKeyValueW RegOpenKeyExW RegGetValueW RegDeleteValueW GetUserNameW BuildExplicitAccessWithNameW SetSecurityInfo GetSecurityInfo SetEntriesInAclW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenSCManagerW CloseServiceHandle ChangeServiceConfigW RegSetValueExW RegCreateKeyExW RegCloseKey LookupAccountSidW CreateWellKnownSid OpenProcessToken

Name

.text

Size

758KB

Virtual Size

757KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_66ec20879b93de0ace52627744dacad2_cobalt-strike_icedid_njrat_satacom_stealc_vidar

shlwapi

kernel32

user32

shell32

ole32

advapi32

generic