2026-09-29_5817e37f05f0553f052fc38c16d8f59f_cobalt-strike_icedid_satacom_stealc_vidar

General

Target
2026-09-29_5817e37f05f0553f052fc38c16d8f59f_cobalt-strike_icedid_satacom_stealc_vidar
Size 3.3MB
Sample260930-aw7snstdrf
SHA256 6dc842f1071b16e32870ad65ae6cd2eeac7498e31ec9ad6b67a17d78f3e503a9
MD5 5817e37f05f0553f052fc38c16d8f59f
SHA1 4f2cbfac380f2df2d2e3ed09ed528f9e4f4e3c85
SHA512 04856de110b4ac1d6723688dc50074512e8bd4c3eefc19af6b8874ea0ad3953c755960df9bd660d5aaff27afbf14633b1b3c71a275dadd276d6b13498b74efb6
SSDEEP 49152:XtxhdgQNOHBSYl1Vy6fl7uRcCuVYGF1tjre6x5Sd3VIr2KNV40Faw+ytX:XIHBSYlO60RzurFjrJYe2KHaw+y
TLSH
T1D9F51207AD95906FF93AE538C6934615D7F27C004782DADB8344C6F62EB32B45BAB390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_5817e37f05f0553f052fc38c16d8f59f_cobalt-strike_icedid_satacom_stealc_vidar

File Explorer

2026-09-29_5817e37f05f0553f052fc38c16d8f59f_cobalt-strike_icedid_satacom_stealc_vidar

.exe 3.3MB

2026-09-29_5817e37f05f0553f052fc38c16d8f59f_cobalt-strike_icedid_satacom_stealc_vidar

IMPHASH 79d62ec3e76f877bb52cfe7bdf9985b0
SHA256 6dc842f1071b16e32870ad65ae6cd2eeac7498e31ec9ad6b67a17d78f3e503a9
MD5 5817e37f05f0553f052fc38c16d8f59f
SHA1 4f2cbfac380f2df2d2e3ed09ed528f9e4f4e3c85
SHA512 04856de110b4ac1d6723688dc50074512e8bd4c3eefc19af6b8874ea0ad3953c755960df9bd660d5aaff27afbf14633b1b3c71a275dadd276d6b13498b74efb6
SSDEEP 49152:XtxhdgQNOHBSYl1Vy6fl7uRcCuVYGF1tjre6x5Sd3VIr2KNV40Faw+ytX:XIHBSYlO60RzurFjrJYe2KHaw+y
TLSH
T1D9F51207AD95906FF93AE538C6934615D7F27C004782DADB8344C6F62EB32B45BAB390
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

75392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WriteConsoleW CreateFileW SetEndOfFile GetModuleHandleW GetCommandLineA GetCurrentProcess GetProcAddress CloseHandle LoadLibraryA HeapSize RtlAddFunctionTable GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter GetSystemTimeAsFileTime GetStringTypeW GetCPInfo GetCurrentProcessId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess HeapAlloc GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineW GetEnvironmentStringsW RtlUnwind

user32

UnhookWindowsHook FindWindowA

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegQueryValueExA OpenProcessToken RegOpenKeyExA RegOpenKeyExW RegQueryValueExW

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

Name

.text

Size

179KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

145KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_5817e37f05f0553f052fc38c16d8f59f_cobalt-strike_icedid_satacom_stealc_vidar

kernel32

user32

advapi32

ntdll

generic