General
- Target 2026-09-04_ca3201596faea234e3484f81a43c21be_cobalt-strike_icedid_satacom_vidar
- Size 1.1MB
- Sample260904-1f7e3sam4t
- SHA256 caf31afd09ab6e0a8515f51570be4a212bbc98545176a72e64c217d649b4e37c
- MD5 ca3201596faea234e3484f81a43c21be
- SHA1 c36b07e888a2e87e7a2f8341b659af4ec8e23579
- SHA512 e3badd1dac0a3d2c954f00fa086614bbfb12c275a777c3319c02fd190fa05cab9ca489e221682f9edfe7fe69b582a8e9b621e75de10f69741e431221c5bb0366
- SSDEEP 24576:RhyIWp7AFKB/i0sAZ+p3+VAqLP3F6Twe65vyMlBrg8PJHFop:jJeUE/MAZ+h4vLP3F6TI5vyj8PTop
- TLSH T15145AD4AFF6804A6C03B83BE45A1180BDFA67EC52B35E6DB325179718B336C11925F87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-04_ca3201596faea234e3484f81a43c21be_cobalt-strike_icedid_satacom_vidar.exe
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-04_ca3201596faea234e3484f81a43c21be_cobalt-strike_icedid_satacom_vidar.exe
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-09-04_ca3201596faea234e3484f81a43c21be_cobalt-strike_icedid_satacom_vidar
- Size 1.1MB
- SHA256 caf31afd09ab6e0a8515f51570be4a212bbc98545176a72e64c217d649b4e37c
- MD5 ca3201596faea234e3484f81a43c21be
- SHA1 c36b07e888a2e87e7a2f8341b659af4ec8e23579
- SHA512 e3badd1dac0a3d2c954f00fa086614bbfb12c275a777c3319c02fd190fa05cab9ca489e221682f9edfe7fe69b582a8e9b621e75de10f69741e431221c5bb0366
- SSDEEP 24576:RhyIWp7AFKB/i0sAZ+p3+VAqLP3F6Twe65vyMlBrg8PJHFop:jJeUE/MAZ+h4vLP3F6TI5vyj8PTop
- TLSH T15145AD4AFF6804A6C03B83BE45A1180BDFA67EC52B35E6DB325179718B336C11925F87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Suspicious use of NtSetInformationThreadHideFromDebugger