2026-09-04_8ef8d13481d6305a5b3a991d6faa22f0_cobalt-strike_icedid_satacom_stealc_vidar

General

Target
2026-09-04_8ef8d13481d6305a5b3a991d6faa22f0_cobalt-strike_icedid_satacom_stealc_vidar
Size 411KB
Sample260905-d9vxtaek2s
SHA256 7d1e476745efd13a8242e2190ecc6ca8228be7f27e86a28efa56b856cc0c212c
MD5 8ef8d13481d6305a5b3a991d6faa22f0
SHA1 75c71bac8b9dea9f6cafd6dcc33456b6d8e2671d
SHA512 8a04236f5c1db96ee258c84833a25bf9d52b25348a73518faa0977e27a06a500e55697a99767c596ffbe6e7f060a18b2d5f5be298490c6284eaa130b6ff3cd9b
SSDEEP 6144:9mnFJuaGvWaDKLf3kFmArSclkcx12DFKQea5OGU22wza02:CGfKLfQmA+OkI2Oxpq2
TLSH
T1A8949D5BB3A814F8E9A7827CCD464906E677BC150721DBDF13A04A9A3F236D09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_8ef8d13481d6305a5b3a991d6faa22f0_cobalt-strike_icedid_satacom_stealc_vidar

File Explorer

2026-09-04_8ef8d13481d6305a5b3a991d6faa22f0_cobalt-strike_icedid_satacom_stealc_vidar

.exe 411KB

2026-09-04_8ef8d13481d6305a5b3a991d6faa22f0_cobalt-strike_icedid_satacom_stealc_vidar

IMPHASH 18f462e23828324bd4f5429647f6100f
SHA256 7d1e476745efd13a8242e2190ecc6ca8228be7f27e86a28efa56b856cc0c212c
MD5 8ef8d13481d6305a5b3a991d6faa22f0
SHA1 75c71bac8b9dea9f6cafd6dcc33456b6d8e2671d
SHA512 8a04236f5c1db96ee258c84833a25bf9d52b25348a73518faa0977e27a06a500e55697a99767c596ffbe6e7f060a18b2d5f5be298490c6284eaa130b6ff3cd9b
SSDEEP 6144:9mnFJuaGvWaDKLf3kFmArSclkcx12DFKQea5OGU22wza02:CGfKLfQmA+OkI2Oxpq2
TLSH
T1A8949D5BB3A814F8E9A7827CCD464906E677BC150721DBDF13A04A9A3F236D09D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

108808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxA

kernel32

VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameW GetModuleHandleW CreateRemoteThread FormatMessageA SetEnvironmentVariableA SetEnvironmentVariableW GetCurrentProcessId TerminateProcess ResumeThread CreateProcessW WriteConsoleW WaitForSingleObject SetLastError GetLastError CloseHandle SetEndOfFile LoadLibraryW LocalFree GetLocaleInfoEx QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW AreFileApisANSI GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlUnwind GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize

advapi32

RegQueryValueExW RegOpenKeyExW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegSetValueExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_8ef8d13481d6305a5b3a991d6faa22f0_cobalt-strike_icedid_satacom_stealc_vidar

user32

kernel32

advapi32

generic