2026-09-16_978258da2d6fcb304fc5185114aa6afd_cobalt-strike_icedid_njrat_satacom_stealc_vidar

General

Target
2026-09-16_978258da2d6fcb304fc5185114aa6afd_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 469KB
Sample260916-xp84gsvbpb
SHA256 230f16cc5cf6fe3cc7ddab198c1afcdcd9e0a883bdc1cf959f9faf21e4a5de5c
MD5 978258da2d6fcb304fc5185114aa6afd
SHA1 b0a7046be732a05a1ff4f384d837baaed80143da
SHA512 24756a9ee75c24f3c056e307fb4238a2f693d34d3cfc2882c8199f28d4c3d207eec4f331804b79ccd76814c27485c757dea814e58c1061235f28dddee7d9c5d2
SSDEEP 6144:cWNG/wVLplyKI33SwtrkNi66LoZQWxPDZJaCmIYfMBohCUCBFLSFT0I:3NGIVpZAC8rkNi66LqtDZTmryorT0I
TLSH
T112A48D1A63A804F9E0B7D278C9535902E675785A0371EB9F03E8D6762F236D09E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_978258da2d6fcb304fc5185114aa6afd_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-09-16_978258da2d6fcb304fc5185114aa6afd_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 469KB

2026-09-16_978258da2d6fcb304fc5185114aa6afd_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH 2d9009be9c484c6b476881a01918576e
SHA256 230f16cc5cf6fe3cc7ddab198c1afcdcd9e0a883bdc1cf959f9faf21e4a5de5c
MD5 978258da2d6fcb304fc5185114aa6afd
SHA1 b0a7046be732a05a1ff4f384d837baaed80143da
SHA512 24756a9ee75c24f3c056e307fb4238a2f693d34d3cfc2882c8199f28d4c3d207eec4f331804b79ccd76814c27485c757dea814e58c1061235f28dddee7d9c5d2
SSDEEP 6144:cWNG/wVLplyKI33SwtrkNi66LoZQWxPDZJaCmIYfMBohCUCBFLSFT0I:3NGIVpZAC8rkNi66LqtDZTmryorT0I
TLSH
T112A48D1A63A804F9E0B7D278C9535902E675785A0371EB9F03E8D6762F236D09E3EF11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

140624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

jpackageapplauncherw.exe.pdb

user32

GetMessageW TranslateMessage DispatchMessageW PostMessageW CreateWindowExW AllowSetForegroundWindow MessageBoxW

shell32

CommandLineToArgvW

kernel32

GetCommandLineW SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc GetCurrentDirectoryW ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree WriteFile GetStdHandle ExitProcess CloseHandle GetLastError WaitForSingleObject GetExitCodeProcess ResumeThread CreateProcessW GetProcessId AssignProcessToJobObject SetEnvironmentVariableW GetCurrentThreadId LoadLibraryExW GetCurrentProcessId GetLocalTime AllocConsole AttachConsole FreeLibrary GetModuleHandleExW GetProcAddress LoadLibraryW LocalFree FormatMessageW CreateFileW FindClose FindNextFileW GetFileAttributesW SetLastError CreateThread CreateJobObjectW SetInformationJobObject GetModuleHandleW SetDllDirectoryW SetConsoleCtrlHandler RtlUnwind GetEnvironmentVariableW GetSystemDirectoryW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead GetDriveTypeW RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetFullPathNameW

Name

.text

Size

302KB

Virtual Size

301KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

107KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-16_978258da2d6fcb304fc5185114aa6afd_cobalt-strike_icedid_njrat_satacom_stealc_vidar

user32

shell32

kernel32

generic