2026-09-02_c81f718f48dc7863bb85ed20daa08e2b_cobalt-strike_icedid_satacom_vidar

General

Target
2026-09-02_c81f718f48dc7863bb85ed20daa08e2b_cobalt-strike_icedid_satacom_vidar
Size 203KB
Sample260902-stlrjawbrd
SHA256 7a12aeae251e8198c55cef5f290f679b7311f5bd8e02d3c8d107328ca24847c6
MD5 c81f718f48dc7863bb85ed20daa08e2b
SHA1 e6a460d316eeb40d09e73e7503bcb8bd6f3a975f
SHA512 d3c83466d5ea27b6a169e00ceb389c267dec5abfa05eefdea39e9118bada293b4d7a6ecffcfa05f7b948d14f284ec7bab19c059dca89f16611263272beb97978
SSDEEP 3072:sGnATN7uanzuCY2ImqsrRMDUJgNyzKS8R1qmPDam3+uigRKSFccTdu:sGAJ7uGzuTRmqstKNo8NPsc5
TLSH
T171146D6257D41CFCFD6262BA971167C78224722804E181DA33BC87AA4F1F8948E397FD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-02_c81f718f48dc7863bb85ed20daa08e2b_cobalt-strike_icedid_satacom_vidar

File Explorer

2026-09-02_c81f718f48dc7863bb85ed20daa08e2b_cobalt-strike_icedid_satacom_vidar

.exe 203KB

2026-09-02_c81f718f48dc7863bb85ed20daa08e2b_cobalt-strike_icedid_satacom_vidar

IMPHASH ed146f1d08714fd6c84e6cccb409ec17
SHA256 7a12aeae251e8198c55cef5f290f679b7311f5bd8e02d3c8d107328ca24847c6
MD5 c81f718f48dc7863bb85ed20daa08e2b
SHA1 e6a460d316eeb40d09e73e7503bcb8bd6f3a975f
SHA512 d3c83466d5ea27b6a169e00ceb389c267dec5abfa05eefdea39e9118bada293b4d7a6ecffcfa05f7b948d14f284ec7bab19c059dca89f16611263272beb97978
SSDEEP 3072:sGnATN7uanzuCY2ImqsrRMDUJgNyzKS8R1qmPDam3+uigRKSFccTdu:sGAJ7uGzuTRmqstKNo8NPsc5
TLSH
T171146D6257D41CFCFD6262BA971167C78224722804E181DA33BC87AA4F1F8948E397FD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6512

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptGenRandom

kernel32

WriteFile CreateFileW CloseHandle AddVectoredExceptionHandler WaitForSingleObject Sleep GetCurrentProcess ExitProcess CreateThread VirtualAlloc VirtualProtect VirtualQuery VirtualQueryEx GetModuleHandleA GetProcAddress QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteConsoleW GetModuleFileNameW TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-02_c81f718f48dc7863bb85ed20daa08e2b_cobalt-strike_icedid_satacom_vidar

bcrypt

kernel32

generic