2026-09-24_d39d1defe6d042b660bcbd9c63296696_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_d39d1defe6d042b660bcbd9c63296696_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.5MB
Sample260924-deacmayblg
SHA256 626a6e1849af8c0249b939a51262e3ad71551cecb95e9713b8ecba9e3a57a588
MD5 d39d1defe6d042b660bcbd9c63296696
SHA1 0c9da6271f748207683070f7d538305dc9291517
SHA512 78f3e6c17ce019343a5b4588ae99a88ec13f6c3a1d88a1f860d9cf4541536faa3d59bd4bceedc091d464de56000e19045e194f1b7190566cbc3a7bc4b5e08948
SSDEEP 12288:DdBUL8xdz24X92s6ERdwKi6eWxpMOCvshOHplTGjnzvX4V9ZVh0BXQDFsz0A4BHe:DdBUgrRX92x0dEjloipFsT4BH1SlL
TLSH
T122657C1DD802A6DCC05EC475C24AAA024DF43C8B9FD2D4BE944D5AA4129F7F6AF34B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_d39d1defe6d042b660bcbd9c63296696_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-09-24_d39d1defe6d042b660bcbd9c63296696_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.5MB

2026-09-24_d39d1defe6d042b660bcbd9c63296696_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH f482cc77c60bed5d19eadc01b0a6569f
SHA256 626a6e1849af8c0249b939a51262e3ad71551cecb95e9713b8ecba9e3a57a588
MD5 d39d1defe6d042b660bcbd9c63296696
SHA1 0c9da6271f748207683070f7d538305dc9291517
SHA512 78f3e6c17ce019343a5b4588ae99a88ec13f6c3a1d88a1f860d9cf4541536faa3d59bd4bceedc091d464de56000e19045e194f1b7190566cbc3a7bc4b5e08948
SSDEEP 12288:DdBUL8xdz24X92s6ERdwKi6eWxpMOCvshOHplTGjnzvX4V9ZVh0BXQDFsz0A4BHe:DdBUgrRX92x0dEjloipFsT4BH1SlL
TLSH
T122657C1DD802A6DCC05EC475C24AAA024DF43C8B9FD2D4BE944D5AA4129F7F6AF34B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1004168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

inet_ntop ntohs recv setsockopt WSAIoctl shutdown freeaddrinfo closesocket getaddrinfo socket WSAStartup send

user32

GetSystemMetrics GetDC FillRect GetTopWindow GetWindow ReleaseDC IsWindowVisible GetWindowRect PrintWindow GetThreadDesktop ScreenToClient EnumDisplayDevicesA wsprintfA ExitWindowsEx GetShellWindow GetWindowThreadProcessId OpenClipboard GetClipboardData SetThreadDesktop CreateDesktopA OpenDesktopA CloseDesktop SetFocus WindowFromPoint ChildWindowFromPoint GetClassNameA MapVirtualKeyA IsWindow SetWindowPlacement GetWindowPlacement PostMessageA SendMessageA CloseClipboard

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt DeleteDC GetDIBits DeleteObject CreateSolidBrush

shell32

ShellExecuteW ShellExecuteA ShellExecuteExA SHGetKnownFolderPath

ole32

CoGetObject CoTaskMemFree CreateStreamOnHGlobal CoCreateInstance CoUninitialize CoInitializeEx

advapi32

OpenProcessToken GetTokenInformation RegCreateKeyA CreateProcessWithTokenW DuplicateTokenEx RegOpenKeyExA RegDeleteTreeA RegCloseKey RegSetValueExA GetUserNameA

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

wininet

InternetReadFile InternetCloseHandle InternetOpenUrlA InternetOpenA

iphlpapi

GetExtendedUdpTable GetExtendedTcpTable

bcrypt

BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptSetProperty BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptGetProperty

kernel32

LCMapStringW CompareStringW GetCommandLineW GetCommandLineA GetModuleFileNameW GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW RaiseException RtlPcToFileHeader RtlUnwindEx FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW SetLastError GetSystemTimeAsFileTime GetCurrentProcess CloseHandle GetComputerNameA GetExitCodeProcess WriteFile Sleep PeekNamedPipe ReadFile GetProcessHeap HeapAlloc HeapFree CreateToolhelp32Snapshot Process32First Process32Next GetModuleHandleA GetProcAddress GetTempPathA GetTempFileNameA CreateFileA LoadLibraryA DeleteFileA FreeLibrary WideCharToMultiByte GetFileAttributesExW CreateFileW GetFileSize FileTimeToLocalFileTime FileTimeToSystemTime GetSystemInfo GlobalMemoryStatusEx GetTickCount64 FindFirstFileW GetFileSizeEx FindNextFileW FindClose MultiByteToWideChar GetModuleFileNameA GetLastError lstrlenA ExitProcess FindFirstFileA FindNextFileA OpenProcess TerminateProcess CreateProcessA GetTickCount SetFilePointer SetEndOfFile GlobalLock GlobalUnlock QueryFullProcessImageNameA K32GetProcessMemoryInfo SetFilePointerEx GetFileAttributesW CopyFileW CreateProcessW RemoveDirectoryW SetFileAttributesW DeleteFileW GetCurrentThreadId GetTempPathW GetWindowsDirectoryA GetSystemDirectoryA GetEnvironmentVariableA GetFileAttributesA GetEnvironmentVariableW CreateDirectoryW GetSystemDirectoryW GetSystemTimes GetProcessTimes EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetExitCodeThread

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_d39d1defe6d042b660bcbd9c63296696_cobalt-strike_icedid_njrat_satacom_vidar

ws2_32

user32

gdi32

shell32

ole32

advapi32

d3d11

dxgi

wininet

iphlpapi

bcrypt

kernel32

generic