2026-08-31_f8eb5d01b6398a1539409c4d8653a900_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-31_f8eb5d01b6398a1539409c4d8653a900_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 1.4MB
Sample260901-24btracn2x
SHA256 f0566dd3dede9b2f7648ed068aa60f1c3c69a848f00ce7ef2b80c97a44fa058c
MD5 f8eb5d01b6398a1539409c4d8653a900
SHA1 0762da73741302885aef73a5223ccb24216adbe4
SHA512 e2063f2e1f36b5acc01e668175a1f84a4da7391844892f21681ae14d06997d87a1e2d379e860316275f5888e63b818b38962d5b8127dd9f6538c6a752b60b611
SSDEEP 24576:h3der+FXCPsiG76IsJhRAqKHru08sqjnhMgeiCl7G0nehbGZpbD:h3srACk7FGAqOrKDmg27RnWGj
TLSH
T1AD65AE05539806E9D07A913BC542867AF1B1BC160763CADB82B47B5F0F3F9E85E39B24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-31_f8eb5d01b6398a1539409c4d8653a900_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-08-31_f8eb5d01b6398a1539409c4d8653a900_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 1.4MB

2026-08-31_f8eb5d01b6398a1539409c4d8653a900_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH f224118c822d9fb0f02618b0c116949b
SHA256 f0566dd3dede9b2f7648ed068aa60f1c3c69a848f00ce7ef2b80c97a44fa058c
MD5 f8eb5d01b6398a1539409c4d8653a900
SHA1 0762da73741302885aef73a5223ccb24216adbe4
SHA512 e2063f2e1f36b5acc01e668175a1f84a4da7391844892f21681ae14d06997d87a1e2d379e860316275f5888e63b818b38962d5b8127dd9f6538c6a752b60b611
SSDEEP 24576:h3der+FXCPsiG76IsJhRAqKHru08sqjnhMgeiCl7G0nehbGZpbD:h3srACk7FGAqOrKDmg27RnWGj
TLSH
T1AD65AE05539806E9D07A913BC542867AF1B1BC160763CADB82B47B5F0F3F9E85E39B24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

224000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qb\workspace\21461\source\gfx-driver\dump64\gfxui\EventManager\igfxEM\Release\igfxEM.pdb

kernel32

GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalUnlock GlobalLock GlobalHandle GlobalFree MulDiv lstrcmpW lstrcmpiW MultiByteToWideChar WideCharToMultiByte DeleteFileW FindClose FindFirstFileW FindNextFileW GetExitCodeThread GetTickCount CopyFileW LCIDToLocaleName ExpandEnvironmentStringsW SetFileAttributesW GetExitCodeProcess CreateProcessW GetSystemDirectoryW CreateDirectoryW OpenEventW GetCurrentProcessId ProcessIdToSessionId GetFileAttributesW LoadLibraryW WTSGetActiveConsoleSessionId GetLocaleInfoW GetSystemDefaultUILanguage GetUserDefaultUILanguage GetSystemDefaultLangID WriteConsoleW SetEndOfFile CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindFirstFileExW FlushFileBuffers FindResourceExW GetACP IsValidCodePage GetFileSizeEx GetConsoleOutputCP SetFilePointerEx ReadConsoleW GetConsoleMode GetTimeZoneInformation GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetModuleHandleExW ExitProcess WriteFile GetStdHandle MoveFileExW ReadFile VirtualQuery VirtualProtect GetSystemInfo RtlPcToFileHeader RtlUnwindEx GetCPInfo LCMapStringW CompareStringW TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread GetStringTypeW LocalFree GetStartupInfoW GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache GetCurrentProcess InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent GetCurrentThreadId CreateThread Sleep CreateEventW CreateMutexW WaitForSingleObject SetEvent LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc FreeLibrary HeapDestroy SetLastError DecodePointer CloseHandle GetCommandLineW DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException GetOEMCP RtlUnwind

user32

IsChild DestroyWindow MoveWindow SetWindowPos GetMessageW RegisterWindowMessageW UnregisterClassW CreateDialogParamW EndDialog SendDlgItemMessageW GetKeyNameTextW MapVirtualKeyExW SetTimer KillTimer GetSystemMetrics GetSubMenu InsertMenuW TrackPopupMenuEx SetMenuDefaultItem IsWindow GetWindowRect SetWindowContextHelpId MessageBoxW GetCursorPos LoadIconW LoadImageW MapDialogRect GetDisplayConfigBufferSizes CreateDialogIndirectParamW GetDlgItem CharUpperW CharNextW SetFocus GetFocus SetCapture ReleaseCapture CreateAcceleratorTableW SetDisplayConfig QueryDisplayConfig CreateWindowExW GetClassInfoExW RegisterClassExW CallWindowProcW TranslateMessage DefWindowProcW PostThreadMessageW SendMessageW DispatchMessageW SetForegroundWindow DestroyAcceleratorTable GetDC ReleaseDC GetWindowLongPtrW BeginPaint EndPaint InvalidateRect InvalidateRgn RedrawWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW GetClientRect ClientToScreen ScreenToClient GetSysColor FillRect GetWindowLongW IsWindowVisible ShowWindow PostQuitMessage UnregisterDeviceNotification RegisterDeviceNotificationW UnregisterHotKey RegisterHotKey GetKeyboardLayout GetKeyboardLayoutList ActivateKeyboardLayout LoadKeyboardLayoutW MsgWaitForMultipleObjects PeekMessageW FindWindowW DestroyMenu CreatePopupMenu PostMessageW LoadCursorW GetWindow GetClassNameW GetParent GetDesktopWindow SetWindowLongPtrW SetWindowLongW

gdi32

GetObjectW SelectObject GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap GetStockObject BitBlt

advapi32

RegDeleteKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumKeyExW

ole32

CoInitializeEx OleLockRunning OleRun OleUninitialize OleInitialize CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CreateStreamOnHGlobal CLSIDFromProgID CLSIDFromString CoCreateInstance CoReleaseServerProcess CoAddRefServerProcess CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoGetClassObject CoUninitialize StringFromGUID2

oleaut32

SysAllocStringLen SysAllocString GetErrorInfo SysStringLen VariantInit VariantClear VarUI4FromStr SysAllocStringByteLen SysStringByteLen OleCreateFontIndirect UnRegisterTypeLi RegisterTypeLi LoadRegTypeLi LoadTypeLi SysFreeString

setupapi

SetupDiCreateDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDevicePropertyW SetupDiOpenDevRegKey SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiOpenDeviceInfoW

wtsapi32

WTSUnRegisterSessionNotification WTSRegisterSessionNotification

wininet

InternetQueryOptionW InternetOpenW InternetOpenUrlW InternetCloseHandle InternetReadFile

propsys

PSGetPropertyKeyFromName

shell32

Shell_NotifyIconW SHCreateItemFromParsingName SHGetIDListFromObject ord16 SHFileOperationW

shlwapi

StrStrW PathRemoveFileSpecW PathFileExistsW

bcrypt

BCryptEncrypt BCryptCloseAlgorithmProvider BCryptGetProperty BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenerateSymmetricKey BCryptDecrypt

version

GetFileVersionInfoExW VerQueryValueW GetFileVersionInfoSizeExW

Name

.text

Size

475KB

Virtual Size

475KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

148KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-31_f8eb5d01b6398a1539409c4d8653a900_cobalt-strike_icedid_njrat_satacom_stealc_vidar

kernel32

user32

gdi32

advapi32

ole32

oleaut32

setupapi

wtsapi32

wininet

propsys

shell32

shlwapi

bcrypt

version

generic