2026-08-27_de4373c611916955bdfc21d09d7d0270_cobalt-strike_icedid_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-27_de4373c611916955bdfc21d09d7d0270_cobalt-strike_icedid_satacom_vidar
Size 843KB
Sample260828-e2nzzasycw
SHA256 85b7a9472cdc49fe98bf1a4b2630f953416b20884fe1d575cafb593b5711cfc2
MD5 de4373c611916955bdfc21d09d7d0270
SHA1 5aa756d72896cf17c0c67a966bd1c51969a54d22
SHA512 f57f4382394d66963d6ec5423d31de0d47150fd0d16c4ae5a001f67ff3e43f1fd0c72c869c5f45af661971878b25089aeaa84d78288378e3de3b2426e03488ea
SSDEEP 24576:eG3IVFzQTC3wLlzO3CqwD+VrDE9IujDfm:G7QTHxO3CpCRE9Vj7m
TLSH
T1A805024971A418ECE972827989C24D16EBB638215730EBFF03A843914F337E59D3D7A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_de4373c611916955bdfc21d09d7d0270_cobalt-strike_icedid_satacom_vidar

File Explorer

2026-08-27_de4373c611916955bdfc21d09d7d0270_cobalt-strike_icedid_satacom_vidar

.exe 843KB

2026-08-27_de4373c611916955bdfc21d09d7d0270_cobalt-strike_icedid_satacom_vidar

IMPHASH 6b50f12abe4d4fcc7cf1eaa5137efe18
SHA256 85b7a9472cdc49fe98bf1a4b2630f953416b20884fe1d575cafb593b5711cfc2
MD5 de4373c611916955bdfc21d09d7d0270
SHA1 5aa756d72896cf17c0c67a966bd1c51969a54d22
SHA512 f57f4382394d66963d6ec5423d31de0d47150fd0d16c4ae5a001f67ff3e43f1fd0c72c869c5f45af661971878b25089aeaa84d78288378e3de3b2426e03488ea
SSDEEP 24576:eG3IVFzQTC3wLlzO3CqwD+VrDE9IujDfm:G7QTHxO3CpCRE9Vj7m
TLSH
T1A805024971A418ECE972827989C24D16EBB638215730EBFF03A843914F337E59D3D7A6
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

52844

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetProcessHeap RtlCompareMemory lstrcatW lstrcpyW GetModuleFileNameW HeapAlloc GetCurrentThreadId GetLastError CreateFileW HeapReAlloc HeapSize HeapFree SetFilePointerEx ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead ExitProcess RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleExW GetStdHandle WriteFile GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW CloseHandle GetConsoleMode FlushFileBuffers GetConsoleOutputCP WriteConsoleW

Name

.text

Size

136KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

617KB

Virtual Size

616KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_de4373c611916955bdfc21d09d7d0270_cobalt-strike_icedid_satacom_vidar

kernel32

generic