2026-09-29_e55a64412aa5ef5208854a05aab4a2f8_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_e55a64412aa5ef5208854a05aab4a2f8_cobalt-strike_icedid_njrat_satacom_vidar
Size 356KB
Sample260929-r4btmstxes
SHA256 8a39b63dadc63441c2ed4a435e6e628ceaf6ee1126b114f797252d7fb7fe74be
MD5 e55a64412aa5ef5208854a05aab4a2f8
SHA1 38ff59607ea34e48047616c3667e412448a96c87
SHA512 40c767567ad8075136052e6acb97484060831db3d2c3f404d7bb7bb87f0ec374d1da3c65960990ce30aa7145ad4876a2bb2fc8cfe7bc7e7a47bd8cd9e6d6ed81
SSDEEP 6144:SczDlp9malLimFuZPyiIJvL6Fm/Rfohe4DW1cHii:Sctp9malLimEZkJueoBD3
TLSH
T1EB745A06A2E590F9E577C238C806CAB5E6767C05C7609BEF13E06E573F236909E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-29_e55a64412aa5ef5208854a05aab4a2f8_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-09-29_e55a64412aa5ef5208854a05aab4a2f8_cobalt-strike_icedid_njrat_satacom_vidar

.exe 356KB

2026-09-29_e55a64412aa5ef5208854a05aab4a2f8_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 3cd6e1d379f1d1d3097c155c51060461
SHA256 8a39b63dadc63441c2ed4a435e6e628ceaf6ee1126b114f797252d7fb7fe74be
MD5 e55a64412aa5ef5208854a05aab4a2f8
SHA1 38ff59607ea34e48047616c3667e412448a96c87
SHA512 40c767567ad8075136052e6acb97484060831db3d2c3f404d7bb7bb87f0ec374d1da3c65960990ce30aa7145ad4876a2bb2fc8cfe7bc7e7a47bd8cd9e6d6ed81
SSDEEP 6144:SczDlp9malLimFuZPyiIJvL6Fm/Rfohe4DW1cHii:Sctp9malLimEZkJueoBD3
TLSH
T1EB745A06A2E590F9E577C238C806CAB5E6767C05C7609BEF13E06E573F236909E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

93:92:2e:86:52:52:0e:55:60:0b:79:c5:dc:74:6b:eb:a3:2b:3b:77

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

66756

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

MultiByteToWideChar GetModuleFileNameW CreateDirectoryW CopyFileW MoveFileExW DeleteFileW GetSystemWow64DirectoryW ExitProcess GetModuleHandleW TerminateProcess GetSystemDirectoryW GetFileAttributesW HeapFree InitializeCriticalSectionAndSpinCount HeapSize HeapReAlloc RaiseException HeapAlloc DecodePointer GetProcessHeap FreeLibrary lstrcmpiW WideCharToMultiByte LoadResource FindResourceW LoadLibraryExW GetCurrentProcess GetCurrentThreadId SetLastError SetEndOfFile SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FlsFree FlsSetValue SizeofResource WaitForSingleObject GetLastError CreateFileW WriteFile ReadFile LocalFree CloseHandle DeleteCriticalSection GetProcAddress LoadLibraryW LeaveCriticalSection EnterCriticalSection FlsGetValue FlsAlloc ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType GetStdHandle GetModuleHandleExW TlsFree TlsSetValue TlsGetValue WriteConsoleW EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache VirtualAlloc VirtualFree LoadLibraryExA IsDebuggerPresent OutputDebugStringW InitializeCriticalSectionEx LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwindEx RtlPcToFileHeader TlsAlloc RtlUnwind

user32

GetDesktopWindow GetDlgItem EnableWindow MessageBoxW SetWindowPos DialogBoxParamW GetActiveWindow DestroyWindow DefWindowProcW CharNextW UnregisterClassW SetWindowLongPtrW EndDialog GetWindow GetWindowLongW MonitorFromWindow GetMonitorInfoW GetWindowRect GetParent GetClientRect MapWindowPoints

advapi32

RegEnumKeyExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

ShellExecuteExW SHGetSpecialFolderPathW

ole32

CoTaskMemAlloc CoTaskMemFree CoUninitialize CoInitialize CoCreateInstance CoTaskMemRealloc

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

Name

.text

Size

199KB

Virtual Size

198KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_e55a64412aa5ef5208854a05aab4a2f8_cobalt-strike_icedid_njrat_satacom_vidar

PE Signature issue

kernel32

user32

advapi32

shell32

ole32

oleaut32

comctl32

generic