2026-09-20_792b46376f547b132f54eb7cf1406bf6_cobalt-strike_icedid_satacom_vidar

General

Target
2026-09-20_792b46376f547b132f54eb7cf1406bf6_cobalt-strike_icedid_satacom_vidar
Size 652KB
Sample260920-xtrd8szzcs
SHA256 2be9781cd9de2b128b6fa671837cfba9591a47043410dfca734c0e719f9c4263
MD5 792b46376f547b132f54eb7cf1406bf6
SHA1 e81ab2f5f5837ed656e292ae5143cc06f47730a4
SHA512 0089bec605f10c816126a0aeb0682fd26e248bf1b4785865f0ecf08f8949076c8e9342edd4caec4877ec63b3bf67c52b923865d0d3bfff20a5479c0ad2a0361d
SSDEEP 3072:LwazAjvuMeUwZPRyYzK49HcUIcL6aKK2GTrEgQV8FcYX9IQYCl4bGwlX1K:0aMjvuUwZpoUhL6aOSr0V8Fcqb4Dl
TLSH
T1B5E46EEF35D4A194C772C7BC86D45A00EF2CB83DAA321E4A726342142ED3D5F3979A49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-20_792b46376f547b132f54eb7cf1406bf6_cobalt-strike_icedid_satacom_vidar

File Explorer

2026-09-20_792b46376f547b132f54eb7cf1406bf6_cobalt-strike_icedid_satacom_vidar

.exe 652KB

2026-09-20_792b46376f547b132f54eb7cf1406bf6_cobalt-strike_icedid_satacom_vidar

IMPHASH a136217cdd3247ff6a8766561064ca0b
SHA256 2be9781cd9de2b128b6fa671837cfba9591a47043410dfca734c0e719f9c4263
MD5 792b46376f547b132f54eb7cf1406bf6
SHA1 e81ab2f5f5837ed656e292ae5143cc06f47730a4
SHA512 0089bec605f10c816126a0aeb0682fd26e248bf1b4785865f0ecf08f8949076c8e9342edd4caec4877ec63b3bf67c52b923865d0d3bfff20a5479c0ad2a0361d
SSDEEP 3072:LwazAjvuMeUwZPRyYzK49HcUIcL6aKK2GTrEgQV8FcYX9IQYCl4bGwlX1K:0aMjvuUwZpoUhL6aOSr0V8Fcqb4Dl
TLSH
T1B5E46EEF35D4A194C772C7BC86D45A00EF2CB83DAA321E4A726342142ED3D5F3979A49
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4708

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\build\output\unity\unity\artifacts\WindowsPlayer\Win_x64_VS2022_VB_MT_nondev_m_r\WindowsPlayer_player_Master_mono_x64.pdb

unityplayer

UnityMain2

kernel32

HeapAlloc WriteConsoleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW CloseHandle RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-20_792b46376f547b132f54eb7cf1406bf6_cobalt-strike_icedid_satacom_vidar

unityplayer

kernel32

generic