2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.7MB
Sample260910-jsg8aasygt
SHA256 c654b2e5dd0205a3495487ed254c7034812ae1ad84ecfe2973df014be153e02a
MD5 02f1d630782ad46e7ba373808a46a2db
SHA1 45a067d533a4c9de036d8eaf46c81d895440cd72
SHA512 aca2a1a4f0fda8f4c0521e517b8c15b4eb765e2eea075866d1b3b6214a8e254d76117271f32de047706a1e9ce74c10f8802803e1413f910d95d728aae29b3a95
SSDEEP 24576:ouxseUbR9OdN161eYKXXFyLAYCD0sqjnhMgeiCl7G0nehbGZpbD:ouxseUbR9OdN161kXgqDQDmg27RnWGj
TLSH
T17185E09A779407F9E077C17CCA928A46FAB278455720A78F03E44ABA1F137A15D3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.7MB

2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH dcfe8e4934f22f4c49c2912a462216ae
SHA256 c654b2e5dd0205a3495487ed254c7034812ae1ad84ecfe2973df014be153e02a
MD5 02f1d630782ad46e7ba373808a46a2db
SHA1 45a067d533a4c9de036d8eaf46c81d895440cd72
SHA512 aca2a1a4f0fda8f4c0521e517b8c15b4eb765e2eea075866d1b3b6214a8e254d76117271f32de047706a1e9ce74c10f8802803e1413f910d95d728aae29b3a95
SSDEEP 24576:ouxseUbR9OdN161eYKXXFyLAYCD0sqjnhMgeiCl7G0nehbGZpbD:ouxseUbR9OdN161kXgqDQDmg27RnWGj
TLSH
T17185E09A779407F9E077C17CCA928A46FAB278455720A78F03E44ABA1F137A15D3F321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

43168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\jenkins\workspace\dptf\Src\ESIF\Products\ESIF_UF\Sources\win\projs\x64\Win10Release\dptf_helper.pdb

kernel32

GetProcessTimes CreateThread OpenProcess FreeLibrary GetModuleHandleExA GetProcAddress LoadLibraryExA LocalFree QueryFullProcessImageNameW SetDllDirectoryW WriteConsoleW SetEndOfFile HeapReAlloc HeapSize K32GetProcessImageFileNameA CreateToolhelp32Snapshot Process32FirstW Process32NextW GetEnvironmentVariableA FindClose FindFirstFileA FindNextFileA GetTempPathW CreateSemaphoreW SetLastError CreateMutexA GetCurrentProcess WaitForMultipleObjects SetPriorityClass GetSystemDirectoryA GetSystemDirectoryW GetSystemWindowsDirectoryA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW Sleep CreateEventW GetSystemPowerStatus DuplicateHandle CreateFileW FlushFileBuffers ReadFile WriteFile ConnectNamedPipe DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitNamedPipeW GetOverlappedResult WaitForSingleObject ReleaseSemaphore SetEvent AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetLastError CloseHandle GetTempPathA ResetEvent GetTimeZoneInformation SetConsoleCtrlHandler GetProcessHeap GetFileAttributesA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent __C_specific_handler QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedPushEntrySList InterlockedFlushSList FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlUnwindEx EncodePointer RaiseException RtlPcToFileHeader GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetStdHandle ExitProcess GetCommandLineA GetCommandLineW GetCurrentThread HeapFree HeapAlloc MultiByteToWideChar InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW DeleteFileW WideCharToMultiByte RemoveDirectoryW GetConsoleMode ReadConsoleW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx MoveFileExW SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW SetStdHandle CreateDirectoryW OutputDebugStringW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW RtlUnwind

user32

GetWindowThreadProcessId GetGUIThreadInfo

api-ms-win-devices-config-l1-1-1

CM_Register_Notification CM_Unregister_Notification

advapi32

ConvertStringSidToSidW SetSecurityDescriptorDacl InitializeSecurityDescriptor InitializeAcl GetTokenInformation GetLengthSid GetAclInformation AddAce AddAccessAllowedAce LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

Name

.text

Size

385KB

Virtual Size

384KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_02f1d630782ad46e7ba373808a46a2db_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

user32

api-ms-win-devices-config-l1-1-1

advapi32

generic