2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar
Size 8.6MB
Sample260930-dkdbgascng
SHA256 eca6a9f876fe4607b3dd4551031ee8ddab6140e9eb833000f2cf06a7a2546406
MD5 38662e3c7a1a19cbefcbbc38715f8d7f
SHA1 c8f8812eb20d6fd9e8ee58096f674841582a715f
SHA512 3e395c469bcfbb1f7a4b1c8774c8020ae94a1469441794e576e021f29f05be814462d1fa0a64e319ef8ff8975c344cfa0381eef5053070c12758993df14d4242
SSDEEP 98304:Ryq1v/nG8DyVqRlM8sd4zqCKHISj+V3+M4FHXlJTU+M4FHX:Rt33z2+VL4bJ04
TLSH
T197968D13F29941E9E0AED278CB664232E9B37C854B3562DF03507A651E76FE09B3C721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar

File Explorer

2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar

.exe 8.6MB

2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar

IMPHASH 8c75be69e16bc20552247114d17f62ed
SHA256 eca6a9f876fe4607b3dd4551031ee8ddab6140e9eb833000f2cf06a7a2546406
MD5 38662e3c7a1a19cbefcbbc38715f8d7f
SHA1 c8f8812eb20d6fd9e8ee58096f674841582a715f
SHA512 3e395c469bcfbb1f7a4b1c8774c8020ae94a1469441794e576e021f29f05be814462d1fa0a64e319ef8ff8975c344cfa0381eef5053070c12758993df14d4242
SSDEEP 98304:Ryq1v/nG8DyVqRlM8sd4zqCKHISj+V3+M4FHXlJTU+M4FHX:Rt33z2+VL4bJ04
TLSH
T197968D13F29941E9E0AED278CB664232E9B37C854B3562DF03507A651E76FE09B3C721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2992128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

updater.exe.pdb

advapi32

AddAce AllocateAndInitializeSid BuildExplicitAccessWithNameW BuildSecurityDescriptorW BuildTrusteeWithSidW ChangeServiceConfig2W ChangeServiceConfigW CheckTokenMembership CloseServiceHandle ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CopySid CreateProcessAsUserW CreateServiceW DeleteService DuplicateTokenEx EqualSid FreeSid GetAce GetAclInformation GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorLength GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetSecurityInfo GetSidIdentifierAuthority GetSidLengthRequired GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle ImpersonateLoggedOnUser ImpersonateNamedPipeClient InitializeAcl InitializeSecurityDescriptor InitializeSid IsValidAcl IsValidSecurityDescriptor IsValidSid LookupAccountSidW MakeAbsoluteSD MakeSelfRelativeSD OpenProcessToken OpenSCManagerW OpenServiceW OpenThreadToken QueryServiceConfigW QueryServiceStatusEx RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegSetValueExW RegisterServiceCtrlHandlerW RegisterTraceGuidsW RevertToSelf SetEntriesInAclW SetNamedSecurityInfoW SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityInfo SetServiceStatus StartServiceCtrlDispatcherW TraceEvent UnregisterTraceGuids

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

gdi32

BitBlt CombineRgn CreateCompatibleBitmap CreateCompatibleDC CreateFontIndirectW CreateRectRgn CreateRectRgnIndirect CreateSolidBrush DPtoLP DeleteDC DeleteObject ExtTextOutW FillRgn GetDeviceCaps GetObjectW GetRegionData GetStockObject GetTextMetricsW OffsetRgn SelectObject SetBkColor SetTextColor SetViewportOrgEx

msimg32

GradientFill

oleaut32

LoadRegTypeLi LoadTypeLi OleCreateFontIndirect OleLoadPicturePath SafeArrayAccessData SafeArrayCreateVector SafeArrayDestroy SafeArrayGetDim SafeArrayGetLBound SafeArrayGetUBound SafeArrayGetVartype SafeArrayUnaccessData SysAllocString SysAllocStringByteLen SysAllocStringLen SysFreeString SysStringLen SystemTimeToVariantTime VariantClear VariantInit

shell32

CommandLineToArgvW ord680 SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

shlwapi

ord437 PathMatchSpecW

user32

AllowSetForegroundWindow BeginPaint CallWindowProcW CharNextW CharUpperW ClientToScreen CopyImage CopyRect CreateAcceleratorTableW CreateDialogIndirectParamW CreateWindowExW DefWindowProcW DestroyAcceleratorTable DestroyIcon DestroyWindow DispatchMessageW EnableMenuItem EnableWindow EndDialog EndPaint EnumChildWindows FillRect FrameRect GetActiveWindow GetClassInfoExW GetClassNameW GetClientRect GetCursorPos GetDC GetDesktopWindow GetDlgItem GetFocus GetMenuState GetMessageW GetMonitorInfoW GetParent GetQueueStatus GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetTopWindow GetWindow GetWindowLongPtrW GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW InflateRect InvalidateRect InvalidateRgn IsChild IsDialogMessageW IsMenu IsRectEmpty IsWindow IsWindowVisible KillTimer LoadCursorW LoadImageW MapDialogRect MapWindowPoints MonitorFromWindow MoveWindow MsgWaitForMultipleObjectsEx OffsetRect PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW RedrawWindow RegisterClassExW RegisterClassW RegisterWindowMessageW ReleaseCapture ReleaseDC ScreenToClient SendDlgItemMessageW SendMessageW SetActiveWindow SetCapture SetDlgItemTextW SetFocus SetForegroundWindow SetTimer SetWindowContextHelpId SetWindowLongPtrW SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TranslateMessage UnregisterClassW UpdateWindow

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winmm

timeBeginPeriod timeEndPeriod timeGetTime

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler AssignProcessToJobObject CancelIo CloseHandle CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateNamedPipeW CreatePipe CreateProcessW CreateSemaphoreW CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DisconnectNamedPipe DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FindResourceExW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetHandleInformation GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNamedPipeServerProcessId GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProcessMitigationPolicy GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetThreadContext GetThreadId GetThreadLocale GetThreadPreferredUILanguages GetThreadPriority GetThreadPriorityBoost GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserPreferredUILanguages GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalHandle GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapDestroy HeapFree HeapReAlloc HeapSetInformation HeapSize InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock InterlockedPopEntrySList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleInformation K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockFileEx LockResource MapViewOfFile MoveFileExW MoveFileW MulDiv MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA OutputDebugStringW PeekNamedPipe PostQueuedCompletionStatus Process32FirstW Process32NextW ProcessIdToSessionId QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReadProcessMemory RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW RemoveVectoredExceptionHandler ReplaceFileW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetDefaultDllDirectories SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetNamedPipeHandleState SetProcessShutdownParameters SetStdHandle SetThreadInformation SetThreadPriority SetThreadPriorityBoost SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SleepEx SuspendThread SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery VirtualQueryEx WTSGetActiveConsoleSessionId WaitForMultipleObjects WaitForSingleObject WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte Wow64GetThreadContext WriteConsoleW WriteFile lstrcmpW

ole32

CLSIDFromProgID CLSIDFromString CoAddRefServerProcess CoCreateGuid CoCreateInstance CoGetCallContext CoGetClassObject CoInitializeEx CoInitializeSecurity CoRegisterClassObject CoRegisterInitializeSpy CoReleaseServerProcess CoResumeClassObjects CoRevokeClassObject CoRevokeInitializeSpy CoSetProxyBlanket CoTaskMemAlloc CoTaskMemFree CoUninitialize CreateStreamOnHGlobal IIDFromString OleInitialize OleLockRunning OleUninitialize StringFromGUID2

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQuerySessionInformationW

secur32

GetUserNameExW

ntdll

NtDeleteKey NtQueryInformationThread NtQueryObject RtlGetLastNtStatus

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock EnterCriticalPolicySection LeaveCriticalPolicySection UnloadUserProfile

comctl32

InitCommonControlsEx _TrackMouseEvent

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpGetProxyForUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetStatusCallback WinHttpSetTimeouts WinHttpWriteData

uxtheme

SetWindowTheme

Name

.text

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

997KB

Virtual Size

996KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

122KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

157KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

665B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

LZMADEC

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

195B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

615KB

Virtual Size

614KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_38662e3c7a1a19cbefcbbc38715f8d7f_cobalt-strike_icedid_njrat_ryuk_satacom_vidar

advapi32

dbghelp

gdi32

msimg32

oleaut32

shell32

shlwapi

user32

version

winmm

kernel32

ole32

wtsapi32

secur32

ntdll

userenv

comctl32

api-ms-win-core-winrt-l1-1-0

winhttp

uxtheme

generic