2026-09-20_867495530fc15cd3cb72ca80989675a3_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-20_867495530fc15cd3cb72ca80989675a3_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.9MB
Sample260920-xh22lax18l
SHA256 0769aebaf106e8bd8fa478fbaf73d29a8a914f601ca8948c4175bde2316c4d47
MD5 867495530fc15cd3cb72ca80989675a3
SHA1 6b9dc193eaf1a263344be15dfed454bb1b412af3
SHA512 603ef0cf05ea5f28810292a243b8b683368547c45a5fe51588b6da580929926b4c45ff14fd6897cd4e667db0dfea6ec61a6b4e9c71e74959aa4c3a84e9861602
SSDEEP 24576:zAgXeZwhmVm9pKf1ciQLpNa+62Yiq/kpUUhwsqjnhMgeiCl7G0nehbGZpbD:zAguK80Kf6L1vq/ky6sDmg27RnWGj
TLSH
T13395AE5A62A801E9D076D07CCA92C536E6B27C5A03704ADF02E17EA73F776E45E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-20_867495530fc15cd3cb72ca80989675a3_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-09-20_867495530fc15cd3cb72ca80989675a3_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.9MB

2026-09-20_867495530fc15cd3cb72ca80989675a3_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 0a620cca2c20cb9aa26204fb29f40715
SHA256 0769aebaf106e8bd8fa478fbaf73d29a8a914f601ca8948c4175bde2316c4d47
MD5 867495530fc15cd3cb72ca80989675a3
SHA1 6b9dc193eaf1a263344be15dfed454bb1b412af3
SHA512 603ef0cf05ea5f28810292a243b8b683368547c45a5fe51588b6da580929926b4c45ff14fd6897cd4e667db0dfea6ec61a6b4e9c71e74959aa4c3a84e9861602
SSDEEP 24576:zAgXeZwhmVm9pKf1ciQLpNa+62Yiq/kpUUhwsqjnhMgeiCl7G0nehbGZpbD:zAguK80Kf6L1vq/ky6sDmg27RnWGj
TLSH
T13395AE5A62A801E9D076D07CCA92C536E6B27C5A03704ADF02E17EA73F776E45E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

454596

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

InitOnceComplete InitOnceBeginInitialize AcquireSRWLockShared ReleaseSRWLockShared TryEnterCriticalSection InitializeSRWLock RtlCaptureStackBackTrace SetConsoleTextAttribute GetComputerNameA GetWindowsDirectoryA GetTempPathA GetConsoleScreenBufferInfo CreateProcessW PeekNamedPipe GetCommandLineW FreeLibrary GetProcAddress LoadLibraryExW MultiByteToWideChar WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW GetFileAttributesW GetFileAttributesExW ReadFile RemoveDirectoryW SetFileAttributesW WriteFile CloseHandle GetCurrentProcess OutputDebugStringA OutputDebugStringW GetCurrentProcessId GetLocalTime GetTickCount GetModuleFileNameW FormatMessageA DuplicateHandle TerminateProcess GetExitCodeProcess OpenProcess ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW GetCurrentThreadId GetModuleHandleW LoadLibraryW ReleaseSRWLockExclusive TlsGetValue QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThread SetThreadPriority GetThreadPriority GetSystemTimeAsFileTime QueryThreadCycleTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileInformationByHandle GetFileSizeEx SetEndOfFile SetFilePointerEx GetProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW IsDebuggerPresent CreateThread GetThreadId GetModuleHandleExW GetVersionExW GetNativeSystemInfo CreateThreadpool SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum CloseThreadpool CallbackMayRunLong CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork TlsAlloc TlsSetValue TlsFree AcquireSRWLockExclusive CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetSystemDirectoryW GetWindowsDirectoryW ProcessIdToSessionId QueryFullProcessImageNameW WTSGetActiveConsoleSessionId EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead RtlPcToFileHeader RtlUnwindEx GetFullPathNameW SetStdHandle GetFileType GetConsoleOutputCP GetConsoleMode SetConsoleCtrlHandler ExitProcess GetStdHandle WriteConsoleW HeapAlloc HeapFree GetDriveTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc GetTimeZoneInformation HeapSize IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap LocalFree UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateEventW WaitForSingleObject ResetEvent SetEvent SetLastError MoveFileExW MoveFileW CopyFileW GetTempPathW GetTempFileNameW DeleteFileW SetErrorMode DeleteCriticalSection InitializeCriticalSectionEx RaiseException DecodePointer FlushFileBuffers GetLastError CreatePipe

advapi32

CheckTokenMembership SystemFunction036 ConvertSidToStringSidW GetTokenInformation OpenProcessToken RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey AllocateAndInitializeSid RegisterServiceCtrlHandlerW SetServiceStatus StartServiceCtrlDispatcherW ConvertStringSecurityDescriptorToSecurityDescriptorW FreeSid GetUserNameW ChangeServiceConfigW ChangeServiceConfig2W CloseServiceHandle ControlService CreateServiceW DeleteService OpenSCManagerW OpenServiceW QueryServiceStatus StartServiceW DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf

user32

PeekMessageW MsgWaitForMultipleObjectsEx PostMessageW PostQuitMessage GetQueueStatus SetTimer KillTimer DefWindowProcW RegisterClassExW GetWindowLongPtrW SetWindowLongPtrW DispatchMessageW TranslateMessage MonitorFromWindow CharUpperW UnregisterClassW LoadIconW CreateWindowExW DestroyWindow SetWindowPos SetForegroundWindow AllowSetForegroundWindow GetClientRect GetWindowRect MapWindowPoints GetWindowLongW GetParent GetWindow GetMonitorInfoW

shell32

SHGetFolderPathW ShellExecuteExW SHGetKnownFolderPath CommandLineToArgvW

winmm

timeBeginPeriod timeEndPeriod timeGetTime

ole32

CoInitializeEx CoUninitialize CoTaskMemFree

crypt32

CertNameToStrW

shlwapi

PathMatchSpecW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateSessionsW

dbghelp

SymSetOptions SymCleanup SymGetLineFromAddr64 SymInitialize SymFromAddr UnDecorateSymbolName

Name

.text

Size

720KB

Virtual Size

719KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

235KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

401KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-20_867495530fc15cd3cb72ca80989675a3_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

advapi32

user32

shell32

winmm

ole32

crypt32

shlwapi

wtsapi32

dbghelp

generic