2026-09-09_e543e0231f8bd02a9aa8f7ee2c31ddc4_akira_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-09_e543e0231f8bd02a9aa8f7ee2c31ddc4_akira_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.6MB
Sample260909-md1mvsdr41
SHA256 8592d7ed5f16f236325ef8e70b0611fbca864331f7790e7b3cb581d024f22033
MD5 e543e0231f8bd02a9aa8f7ee2c31ddc4
SHA1 230a26d126c4fca76badd30318c562ccaeec7db8
SHA512 915411573597c322729619ea3294eff6a7f13f6aac9408e76bb2f7551499913ecb19c480f48dc2aeeb28f9e178e02e93f704b32c0c6caaf841f85db0d7118261
SSDEEP 49152:7C7Z5CTpmIn9x5vQwXLBymZ0xfJ4klKXnE:7C77Cr9HHXLefJ4k
TLSH
T1C785025A61A502F8E0B7D27C89835A02F3767C4A0371CAEF07A082772F676E15E7E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-09_e543e0231f8bd02a9aa8f7ee2c31ddc4_akira_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-09-09_e543e0231f8bd02a9aa8f7ee2c31ddc4_akira_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.6MB

2026-09-09_e543e0231f8bd02a9aa8f7ee2c31ddc4_akira_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH ae7b916de6d5a560f82f63760f2f8b8a
SHA256 8592d7ed5f16f236325ef8e70b0611fbca864331f7790e7b3cb581d024f22033
MD5 e543e0231f8bd02a9aa8f7ee2c31ddc4
SHA1 230a26d126c4fca76badd30318c562ccaeec7db8
SHA512 915411573597c322729619ea3294eff6a7f13f6aac9408e76bb2f7551499913ecb19c480f48dc2aeeb28f9e178e02e93f704b32c0c6caaf841f85db0d7118261
SSDEEP 49152:7C7Z5CTpmIn9x5vQwXLBymZ0xfJ4klKXnE:7C77Cr9HHXLefJ4k
TLSH
T1C785025A61A502F8E0B7D27C89835A02F3767C4A0371CAEF07A082772F676E15E7E751
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

196316

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Jenkins\workspace\desktop-sdk_yousefi_security-fix\ADP_SDK_Bin\Release\AdpSDKUtil.pdb

kernel32

FindFirstFileW lstrcmpW FindNextFileW FindClose DeleteFileW GetDiskFreeSpaceExW GetFileSizeEx MoveFileExW CopyFileW ReadFile WriteFile FlushFileBuffers SetFilePointerEx TerminateProcess GetCurrentProcessId WaitForSingleObject GetCurrentThreadId SetUnhandledExceptionFilter SetDllDirectoryW LoadLibraryW GetProcAddress FormatMessageW RaiseException IsDebuggerPresent CreateMutexW OpenMutexW ReleaseMutex EnterCriticalSection LeaveCriticalSection SetLastError HeapSize GetConsoleMode GetConsoleOutputCP SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW SetFileAttributesW LocalFree GetLastError RemoveDirectoryW GetTempPathW QueryFullProcessImageNameW GetModuleFileNameW CloseHandle CreateFileW GetFileTime GetCurrentDirectoryW lstrlenW GetFileAttributesW lstrcmpiW FreeLibrary LoadLibraryExW GetModuleHandleExW WideCharToMultiByte GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetCurrentProcess GetDateFormatW HeapAlloc HeapFree GetCommandLineW GetCommandLineA ExitProcess WriteConsoleW GetFileType GetStdHandle TlsFree TlsSetValue TlsGetValue TlsAlloc RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW GetModuleHandleW MultiByteToWideChar CreateEventW InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo LCMapStringEx DeleteCriticalSection GetStringTypeW EncodePointer DecodePointer InitializeCriticalSectionEx

advapi32

FreeSid CheckTokenMembership SetNamedSecurityInfoW SetEntriesInAclW GetNamedSecurityInfoW AllocateAndInitializeSid

shell32

SHGetKnownFolderPath SHCreateDirectoryExW

ole32

CoTaskMemFree

shlwapi

PathCanonicalizeW PathIsRelativeW PathFindExtensionW PathRemoveExtensionW PathFileExistsW PathRemoveFileSpecW PathAppendW PathFindFileNameW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

mpr

WNetGetUniversalNameW

wintrust

WinVerifyTrust WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

Name

.text

Size

349KB

Virtual Size

349KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

615KB

Virtual Size

614KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-09_e543e0231f8bd02a9aa8f7ee2c31ddc4_akira_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

advapi32

shell32

ole32

shlwapi

version

mpr

wintrust

crypt32

generic