2026-08-25_c7d1b26a66fdc1c10efda5f3fcdef72c_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-08-25_c7d1b26a66fdc1c10efda5f3fcdef72c_cobalt-strike_icedid_njrat_satacom_vidar
Size 245KB
Sample260826-lycabswerg
SHA256 b8b0fcd8ab9a224eab923dbaee2f67e4bc1040faf0e4ec32604a455d596abe7a
MD5 c7d1b26a66fdc1c10efda5f3fcdef72c
SHA1 aeb87c9a6d309ca745096e3bf3adae5d903223c4
SHA512 776d8b504f1c34893c4075285557fd0fe6db0455c3155332527f3d56bd2557032a870568095f8e04183f1d7a9201c7ea6b038c4c8298ebd34eac4ef2a957b51c
SSDEEP 6144:NJ62duNtaXgDqqZI6LQ5Z4gEkYy/exqBrvY9NksBHD2D:NJiNtaXgDqqDLWuZJxMY9N92D
TLSH
T1DF346B6ABBEE0AF9E963C974DC3083429B723851C532D75E539007195E63190CFB8FA6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_c7d1b26a66fdc1c10efda5f3fcdef72c_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-08-25_c7d1b26a66fdc1c10efda5f3fcdef72c_cobalt-strike_icedid_njrat_satacom_vidar

.exe 245KB

2026-08-25_c7d1b26a66fdc1c10efda5f3fcdef72c_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 51ed0838f73a8611bdbc07e0e25123c2
SHA256 b8b0fcd8ab9a224eab923dbaee2f67e4bc1040faf0e4ec32604a455d596abe7a
MD5 c7d1b26a66fdc1c10efda5f3fcdef72c
SHA1 aeb87c9a6d309ca745096e3bf3adae5d903223c4
SHA512 776d8b504f1c34893c4075285557fd0fe6db0455c3155332527f3d56bd2557032a870568095f8e04183f1d7a9201c7ea6b038c4c8298ebd34eac4ef2a957b51c
SSDEEP 6144:NJ62duNtaXgDqqZI6LQ5Z4gEkYy/exqBrvY9NksBHD2D:NJiNtaXgDqqDLWuZJxMY9N92D
TLSH
T1DF346B6ABBEE0AF9E963C974DC3083429B723851C532D75E539007195E63190CFB8FA6
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

30608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\MALDEV01\source\repos\eb\x64\Release\eb.pdb

kernel32

Process32FirstW HeapReAlloc GetCurrentThread Process32NextW GetLastError Sleep CreateToolhelp32Snapshot GetFileAttributesW CreateFileW SetThreadPriority DeviceIoControl WriteFile GetCurrentProcess CloseHandle SetPriorityClass RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap SetFilePointerEx GetFileSizeEx HeapSize WriteConsoleW

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW DeleteService ControlService OpenProcessToken StartServiceW OpenServiceW GetTokenInformation

Name

.text

Size

118KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_c7d1b26a66fdc1c10efda5f3fcdef72c_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

advapi32

generic