2026-09-24_8e86e0fa99da90baf465cf16c2fd7426_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_8e86e0fa99da90baf465cf16c2fd7426_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.5MB
Sample260925-fml3hazelh
SHA256 d1a6f49c882e33f6eb7c63428712d380b5ba90e4dcc9b5b0966bf15b5da334b0
MD5 8e86e0fa99da90baf465cf16c2fd7426
SHA1 0347151c4a285d081092f56bcc6d90f5f5670f79
SHA512 f9227ae4eb98d22963eb9da64f9ec7283f80a65efcc7a54e35f0c2e6ae764e092f5c3fb7c16c4e2acc0cc347af8f7026f5cbd12c10e9ebb8763228ec84124409
SSDEEP 12288:adBUe8xdB24X92s6ERdwKi6eWxpMOCvshOHpl4GjnzvX4V9ZVh0BXQDFsIE7WvjT:adBUxpRX92x0dEjl9ipFs0H3
TLSH
T1DD657C1DD906A5DCC00EC475C6468A120DF43C9B9FD698BEA44C5AE8123F5F6AF34BAC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-24_8e86e0fa99da90baf465cf16c2fd7426_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-09-24_8e86e0fa99da90baf465cf16c2fd7426_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.5MB

2026-09-24_8e86e0fa99da90baf465cf16c2fd7426_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH f482cc77c60bed5d19eadc01b0a6569f
SHA256 d1a6f49c882e33f6eb7c63428712d380b5ba90e4dcc9b5b0966bf15b5da334b0
MD5 8e86e0fa99da90baf465cf16c2fd7426
SHA1 0347151c4a285d081092f56bcc6d90f5f5670f79
SHA512 f9227ae4eb98d22963eb9da64f9ec7283f80a65efcc7a54e35f0c2e6ae764e092f5c3fb7c16c4e2acc0cc347af8f7026f5cbd12c10e9ebb8763228ec84124409
SSDEEP 12288:adBUe8xdB24X92s6ERdwKi6eWxpMOCvshOHpl4GjnzvX4V9ZVh0BXQDFsIE7WvjT:adBUxpRX92x0dEjl9ipFs0H3
TLSH
T1DD657C1DD906A5DCC00EC475C6468A120DF43C9B9FD698BEA44C5AE8123F5F6AF34BAC
MD5 SHA1 SHA512 SSDEEP TLSH

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1004168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

inet_ntop ntohs recv setsockopt WSAIoctl shutdown freeaddrinfo closesocket getaddrinfo socket WSAStartup send

user32

GetSystemMetrics GetDC FillRect GetTopWindow GetWindow ReleaseDC IsWindowVisible GetWindowRect PrintWindow GetThreadDesktop ScreenToClient EnumDisplayDevicesA wsprintfA ExitWindowsEx GetShellWindow GetWindowThreadProcessId OpenClipboard GetClipboardData SetThreadDesktop CreateDesktopA OpenDesktopA CloseDesktop SetFocus WindowFromPoint ChildWindowFromPoint GetClassNameA MapVirtualKeyA IsWindow SetWindowPlacement GetWindowPlacement PostMessageA SendMessageA CloseClipboard

gdi32

CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt DeleteDC GetDIBits DeleteObject CreateSolidBrush

shell32

ShellExecuteW ShellExecuteA ShellExecuteExA SHGetKnownFolderPath

ole32

CoGetObject CoTaskMemFree CreateStreamOnHGlobal CoCreateInstance CoUninitialize CoInitializeEx

advapi32

OpenProcessToken GetTokenInformation RegCreateKeyA CreateProcessWithTokenW DuplicateTokenEx RegOpenKeyExA RegDeleteTreeA RegCloseKey RegSetValueExA GetUserNameA

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

wininet

InternetReadFile InternetCloseHandle InternetOpenUrlA InternetOpenA

iphlpapi

GetExtendedUdpTable GetExtendedTcpTable

bcrypt

BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptSetProperty BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptGetProperty

kernel32

LCMapStringW CompareStringW GetCommandLineW GetCommandLineA GetModuleFileNameW GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW RaiseException RtlPcToFileHeader RtlUnwindEx FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW SetLastError GetSystemTimeAsFileTime GetCurrentProcess CloseHandle GetComputerNameA GetExitCodeProcess WriteFile Sleep PeekNamedPipe ReadFile GetProcessHeap HeapAlloc HeapFree CreateToolhelp32Snapshot Process32First Process32Next GetModuleHandleA GetProcAddress GetTempPathA GetTempFileNameA CreateFileA LoadLibraryA DeleteFileA FreeLibrary WideCharToMultiByte GetFileAttributesExW CreateFileW GetFileSize FileTimeToLocalFileTime FileTimeToSystemTime GetSystemInfo GlobalMemoryStatusEx GetTickCount64 FindFirstFileW GetFileSizeEx FindNextFileW FindClose MultiByteToWideChar GetModuleFileNameA GetLastError lstrlenA ExitProcess FindFirstFileA FindNextFileA OpenProcess TerminateProcess CreateProcessA GetTickCount SetFilePointer SetEndOfFile GlobalLock GlobalUnlock QueryFullProcessImageNameA K32GetProcessMemoryInfo SetFilePointerEx GetFileAttributesW CopyFileW CreateProcessW RemoveDirectoryW SetFileAttributesW DeleteFileW GetCurrentThreadId GetTempPathW GetWindowsDirectoryA GetSystemDirectoryA GetEnvironmentVariableA GetFileAttributesA GetEnvironmentVariableW CreateDirectoryW GetSystemDirectoryW GetSystemTimes GetProcessTimes EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetExitCodeThread

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_8e86e0fa99da90baf465cf16c2fd7426_cobalt-strike_icedid_njrat_satacom_vidar

ws2_32

user32

gdi32

shell32

ole32

advapi32

d3d11

dxgi

wininet

iphlpapi

bcrypt

kernel32

generic