2026-09-21_4bbd399d501e12070e49699cc5fabcfa_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-09-21_4bbd399d501e12070e49699cc5fabcfa_cobalt-strike_icedid_njrat_satacom_vidar
Size 256KB
Sample260922-qph4qstyey
SHA256 7daf04a3498c969f55cdf52265f30764ca08e53f469ad6de61bbd6f208b0fbf9
MD5 4bbd399d501e12070e49699cc5fabcfa
SHA1 0cee434260958cd3b2a7f71e41b7a4b3d7cdbd0b
SHA512 5e528b4222e58d3bd0486b30450cc79505f50d9b35d75e0fe7a5e5bbd42b9a7b26a0857f054a9e61b9a2dbb0f2ecdb9f27020205c26032db63ee4b4786f344cb
SSDEEP 6144:rrMDZe1lXAIAi+V6JGFflSUKnQrzLGtaF:rg87wi+1Fffr
TLSH
T1B7445B56B3A508FAED77823C88531A06E77278120B21CBAF0764477A5F277D09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-21_4bbd399d501e12070e49699cc5fabcfa_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-09-21_4bbd399d501e12070e49699cc5fabcfa_cobalt-strike_icedid_njrat_satacom_vidar

.exe 256KB

2026-09-21_4bbd399d501e12070e49699cc5fabcfa_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 56bfda7073ea0a159d22e925194a7054
SHA256 7daf04a3498c969f55cdf52265f30764ca08e53f469ad6de61bbd6f208b0fbf9
MD5 4bbd399d501e12070e49699cc5fabcfa
SHA1 0cee434260958cd3b2a7f71e41b7a4b3d7cdbd0b
SHA512 5e528b4222e58d3bd0486b30450cc79505f50d9b35d75e0fe7a5e5bbd42b9a7b26a0857f054a9e61b9a2dbb0f2ecdb9f27020205c26032db63ee4b4786f344cb
SSDEEP 6144:rrMDZe1lXAIAi+V6JGFflSUKnQrzLGtaF:rg87wi+1Fffr
TLSH
T1B7445B56B3A508FAED77823C88531A06E77278120B21CBAF0764477A5F277D09D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW RegCloseKey RegCreateKeyExW RegSetValueExW OpenProcessToken

kernel32

SetFileAttributesW CloseHandle GetLastError WaitForSingleObject CreateMutexW GetCurrentProcess CreateProcessW OpenProcess GetModuleFileNameW CopyFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateRemoteThread VirtualAllocEx WriteProcessMemory WriteConsoleW CreateFileW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW TerminateProcess GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

shell32

SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-21_4bbd399d501e12070e49699cc5fabcfa_cobalt-strike_icedid_njrat_satacom_vidar

advapi32

kernel32

shell32

generic