2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.6MB
Sample261002-3l4bqaxzhy
SHA256 c5b2c393cc07defbb3095b13739ba6bb43acf4b143bc5ad16c1bfd9c975e6289
MD5 e809792c7ffaf047c6d4a79afe14476b
SHA1 d93bfdac1dd7adef4dd98411c9ae9a7e782c0505
SHA512 6db5454b8e844e5ee93cd7e2aff31cd38d3f47d827fb7500b931a7b94cf61ffa06b6afab48c857934d427ebaa6e969cc425d2fc138d39c74bffa7d546c3e361c
SSDEEP 24576:uPKqkoHgyeLThKIJJI1+DMp7CjWgNlPU51Ncv:kgpvY1+DMCjz7PU5u
TLSH
T12175AD5AA6A803E4C4B6D1388952E53AF9713C56433097DB17D1BF2B3F32AE1993B710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.6MB

2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH d74a7ab8517e7ea97269d099407db825
SHA256 c5b2c393cc07defbb3095b13739ba6bb43acf4b143bc5ad16c1bfd9c975e6289
MD5 e809792c7ffaf047c6d4a79afe14476b
SHA1 d93bfdac1dd7adef4dd98411c9ae9a7e782c0505
SHA512 6db5454b8e844e5ee93cd7e2aff31cd38d3f47d827fb7500b931a7b94cf61ffa06b6afab48c857934d427ebaa6e969cc425d2fc138d39c74bffa7d546c3e361c
SSDEEP 24576:uPKqkoHgyeLThKIJJI1+DMp7CjWgNlPU51Ncv:kgpvY1+DMCjz7PU5u
TLSH
T12175AD5AA6A803E4C4B6D1388952E53AF9713C56433097DB17D1BF2B3F32AE1993B710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

209592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\constructicon\builds\gfx\six\23.19\install\Neoma\InstallNeoma\IN_Apps\Bin\Win64a\B_rel\Setup.pdb

kernel32

GetLastError WaitForSingleObject GetExitCodeProcess CreateProcessW GetModuleFileNameW SetDefaultDllDirectories lstrlenW MultiByteToWideChar CreateFileW GetLogicalDriveStringsW HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetSystemInfo GetProcAddress LocalAlloc LocalFree WideCharToMultiByte GetUserDefaultUILanguage CloseHandle FindNextFileW SetEvent CreateEventA HeapSize WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage GetTimeZoneInformation HeapReAlloc SetStdHandle ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale OutputDebugStringW GetDriveTypeW FindClose GetModuleHandleW RaiseException VirtualProtect VirtualQuery FreeLibrary LoadLibraryExA FormatMessageA GetStringTypeW GetCurrentDirectoryW FindFirstFileExW GetFileAttributesExW GetFullPathNameW SetEndOfFile SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount CreateEventW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RtlUnwindEx SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetStdHandle WriteFile GetACP CompareStringW LCMapStringW GetLocaleInfoW RtlUnwind

imagehlp

ImageGetCertificateData ImageEnumerateCertificates

crypt32

CertGetNameStringW CertFreeCertificateContext CryptVerifyMessageSignature

Name

.text

Size

360KB

Virtual Size

359KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

568KB

Virtual Size

567KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_e809792c7ffaf047c6d4a79afe14476b_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

imagehlp

crypt32

generic