cobaltstrike | 2026-10-01_4e61a0a33306fa6bf40ff0afb2b0cd3f_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_4e61a0a33306fa6bf40ff0afb2b0cd3f_cobalt-strike_icedid_njrat_satacom_vidar
Size 370KB
Sample261002-sdx5mawsas
SHA256 8fa0db6ae576571b268fb23d02005e2a162aba35cbb2b7a4ad6057a504b8d922
MD5 4e61a0a33306fa6bf40ff0afb2b0cd3f
SHA1 e540d052667681ed42c2cb7bee693b3fb46ad9a9
SHA512 be94b468e7dbea63862055d9984930323075f11d43ba85dc4cc14174fe349d2eed683d3b859e0d0636395be2dde26b06fee057503f76c608c1b704529689f7c5
SSDEEP 3072:Z23jyrPJocu2EQlCz7WuLyA9ay0eTKNqFEoLDBLWbrl05XoY46BU4spYR9r:Ee7Cn2dlCPWuL9ayLKeJLWQohlRc9r
TLSH
T17D841365EA32FE54CB4B243D2444985FC5A72E185DF1873FC3908B194A4BBC05B6F2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan backdoor cobaltstrike

Malware Config

Extracted

Family

cobaltstrike

http://43.138.112.112:8080/Ne3w

Attributes

user_agent
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSCOM)

Signatures

Family: Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
trojan backdoor cobaltstrike

Detects ransomware indicator 1 IoCs

resource	yara_rule
sample	SUSP_RANSOMWARE_Indicator_Jul20

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_4e61a0a33306fa6bf40ff0afb2b0cd3f_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-10-01_4e61a0a33306fa6bf40ff0afb2b0cd3f_cobalt-strike_icedid_njrat_satacom_vidar

.exe 370KB

2026-10-01_4e61a0a33306fa6bf40ff0afb2b0cd3f_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH cf2314ac1267136ee3251647968e4f72
SHA256 8fa0db6ae576571b268fb23d02005e2a162aba35cbb2b7a4ad6057a504b8d922
MD5 4e61a0a33306fa6bf40ff0afb2b0cd3f
SHA1 e540d052667681ed42c2cb7bee693b3fb46ad9a9
SHA512 be94b468e7dbea63862055d9984930323075f11d43ba85dc4cc14174fe349d2eed683d3b859e0d0636395be2dde26b06fee057503f76c608c1b704529689f7c5
SSDEEP 3072:Z23jyrPJocu2EQlCz7WuLyA9ay0eTKNqFEoLDBLWbrl05XoY46BU4spYR9r:Ee7Cn2dlCPWuL9ayLKeJLWQohlRc9r
TLSH
T17D841365EA32FE54CB4B243D2444985FC5A72E185DF1873FC3908B194A4BBC05B6F2BA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects ransomware indicator
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\root\source\repos\Project2\x64\Release\Project2.pdb

kernel32

WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree CloseHandle CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap CreateFileW HeapSize WriteConsoleW SetEndOfFile RtlUnwind

Name

.text

Size

169KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

77KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rdata2

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-10-01_4e61a0a33306fa6bf40ff0afb2b0cd3f_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

generic