2026-09-21_7339e6050de1d739b29028f3540e0cfa_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-21_7339e6050de1d739b29028f3540e0cfa_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 1.7MB
Sample260922-plp77sec83
SHA256 6b5f7133ca8376a9ba6ab6196072cd7566aa1a258134430ff90c41062d8ada29
MD5 7339e6050de1d739b29028f3540e0cfa
SHA1 23631b0e345acc8c7ccf9986501281339cc20e46
SHA512 33f6339b23c88072f13736767d95c3d188d7859de9c7e6ed4eda26ccd450dab3d1bbf77ada57956bb10ceba76c9765835ae3251e3ebbd7bb73962b4de8917bba
SSDEEP 49152:8ILhT+avhLgJCoSeSYqltE/EpmMbx5AR:8IkbJCFeu7IMd5A
TLSH
T123859C456E9BC4E9D17FA17FCA460D42E5AEF601071396CB0B905A753F23AD30D3A3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-21_7339e6050de1d739b29028f3540e0cfa_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-09-21_7339e6050de1d739b29028f3540e0cfa_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 1.7MB

2026-09-21_7339e6050de1d739b29028f3540e0cfa_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH 69378ff93da90cfd6e740d45d1d62099
SHA256 6b5f7133ca8376a9ba6ab6196072cd7566aa1a258134430ff90c41062d8ada29
MD5 7339e6050de1d739b29028f3540e0cfa
SHA1 23631b0e345acc8c7ccf9986501281339cc20e46
SHA512 33f6339b23c88072f13736767d95c3d188d7859de9c7e6ed4eda26ccd450dab3d1bbf77ada57956bb10ceba76c9765835ae3251e3ebbd7bb73962b4de8917bba
SSDEEP 49152:8ILhT+avhLgJCoSeSYqltE/EpmMbx5AR:8IkbJCFeu7IMd5A
TLSH
T123859C456E9BC4E9D17FA17FCA460D42E5AEF601071396CB0B905A753F23AD30D3A3A2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

434800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\gcomp\rel\src\NvContainer\_out\x86_64\release\container\NvContainer.pdb

shlwapi

PathIsRelativeW

kernel32

LocalAlloc LocalFree ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW OutputDebugStringA Sleep GetCurrentThreadId ProcessIdToSessionId GetSystemTime GetSystemTimeAsFileTime CreateTimerQueueTimer DeleteTimerQueueTimer GetModuleFileNameW GetModuleHandleExW MoveFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW FreeLibrary FindCloseChangeNotification FindFirstChangeNotificationW FindNextChangeNotification GetCurrentDirectoryW SetLastError GetErrorMode SetErrorMode LoadLibraryExW VerSetConditionMask GetCurrentProcessId GetFullPathNameW CreateProcessA CreateProcessW GetSystemDirectoryW GetModuleFileNameA VerifyVersionInfoW MultiByteToWideChar WideCharToMultiByte RemoveDirectoryW DeviceIoControl VirtualQuery VirtualProtect GetSystemInfo WriteConsoleW HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage OutputDebugStringW GetStringTypeW HeapReAlloc ReadConsoleW ReadFile SetStdHandle GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetLastError GetProcAddress GetModuleHandleA RemoveVectoredContinueHandler AddVectoredContinueHandler RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetUnhandledExceptionFilter RtlCaptureStackBackTrace GetModuleHandleW OpenProcess RtlUnwind CreateThread WaitForMultipleObjects OpenEventW CreateEventW WaitForSingleObject SetEvent CloseHandle GetCurrentProcess GetProcessTimes SetDefaultDllDirectories LoadLibraryExA CreateFileW FormatMessageA SetCurrentDirectoryW FindFirstFileExW GetDiskFreeSpaceExW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW SetEndOfFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime GetTempPathW AreFileApisANSI CreateDirectoryExW CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedPushEntrySList InterlockedFlushSList RtlPcToFileHeader RaiseException RtlUnwindEx EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetFileType GetCPInfo GetStdHandle WriteFile GetCurrentThread HeapAlloc HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleCtrlHandler FlushFileBuffers

user32

LoadStringW PostThreadMessageW PeekMessageW GetMessageW ShutdownBlockReasonDestroy ShutdownBlockReasonCreate SetWindowLongPtrW GetWindowLongPtrW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW PostMessageW DispatchMessageW TranslateMessage

shell32

SHGetKnownFolderPath CommandLineToArgvW

ole32

CoTaskMemFree

advapi32

RegisterServiceCtrlHandlerExW RegSetKeyValueW RegOpenKeyExW RegGetValueW RegDeleteValueW GetUserNameW BuildExplicitAccessWithNameW SetSecurityInfo GetSecurityInfo SetEntriesInAclW StartServiceCtrlDispatcherW SetServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle ChangeServiceConfigW RegSetValueExW RegCreateKeyExW RegCloseKey LookupAccountSidW CreateWellKnownSid OpenProcessToken

Name

.text

Size

845KB

Virtual Size

844KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

183KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-21_7339e6050de1d739b29028f3540e0cfa_cobalt-strike_icedid_njrat_satacom_stealc_vidar

shlwapi

kernel32

user32

shell32

ole32

advapi32

generic