2026-10-02_38656f5d9081586783f4ac4e2abda404_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_38656f5d9081586783f4ac4e2abda404_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.9MB
Sample261003-rtz4gsdf93
SHA256 7df27c8d8e0a977b695d6489d7c5346305f5dcce796bc6d61c3e3be814bddee1
MD5 38656f5d9081586783f4ac4e2abda404
SHA1 639794e3842eed5c09cce6aaebf9a7efd3fba3e8
SHA512 e6fd9b202f74987827231950ada37cce28c3d93bfd96a8700fbad8ca63170f12ca0a3256cf9f71c50b01904b42b00c54a25253e2f8ff0c9b501a521e656fb660
SSDEEP 24576:xAgXeZwhmVm9NKf1ciQLpNa+62Yiq/kpUUhxsqjnhMgeiCl7G0nehbGZpbD:xAguK8cKf6L1vq/ky6FDmg27RnWGj
TLSH
T10D95AE5A62A801E9D076D07CCA92C536E6B27C5A03704ADF02E17EA73F776E45E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_38656f5d9081586783f4ac4e2abda404_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-10-02_38656f5d9081586783f4ac4e2abda404_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.9MB

2026-10-02_38656f5d9081586783f4ac4e2abda404_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 0a620cca2c20cb9aa26204fb29f40715
SHA256 7df27c8d8e0a977b695d6489d7c5346305f5dcce796bc6d61c3e3be814bddee1
MD5 38656f5d9081586783f4ac4e2abda404
SHA1 639794e3842eed5c09cce6aaebf9a7efd3fba3e8
SHA512 e6fd9b202f74987827231950ada37cce28c3d93bfd96a8700fbad8ca63170f12ca0a3256cf9f71c50b01904b42b00c54a25253e2f8ff0c9b501a521e656fb660
SSDEEP 24576:xAgXeZwhmVm9NKf1ciQLpNa+62Yiq/kpUUhxsqjnhMgeiCl7G0nehbGZpbD:xAguK8cKf6L1vq/ky6FDmg27RnWGj
TLSH
T10D95AE5A62A801E9D076D07CCA92C536E6B27C5A03704ADF02E17EA73F776E45E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

454596

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

InitOnceComplete InitOnceBeginInitialize AcquireSRWLockShared ReleaseSRWLockShared TryEnterCriticalSection InitializeSRWLock RtlCaptureStackBackTrace SetConsoleTextAttribute GetComputerNameA GetWindowsDirectoryA GetTempPathA GetConsoleScreenBufferInfo CreateProcessW PeekNamedPipe GetCommandLineW FreeLibrary GetProcAddress LoadLibraryExW MultiByteToWideChar WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW GetFileAttributesW GetFileAttributesExW ReadFile RemoveDirectoryW SetFileAttributesW WriteFile CloseHandle GetCurrentProcess OutputDebugStringA OutputDebugStringW GetCurrentProcessId GetLocalTime GetTickCount GetModuleFileNameW FormatMessageA DuplicateHandle TerminateProcess GetExitCodeProcess OpenProcess ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW GetCurrentThreadId GetModuleHandleW LoadLibraryW ReleaseSRWLockExclusive TlsGetValue QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThread SetThreadPriority GetThreadPriority GetSystemTimeAsFileTime QueryThreadCycleTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileInformationByHandle GetFileSizeEx SetEndOfFile SetFilePointerEx GetProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW IsDebuggerPresent CreateThread GetThreadId GetModuleHandleExW GetVersionExW GetNativeSystemInfo CreateThreadpool SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum CloseThreadpool CallbackMayRunLong CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork TlsAlloc TlsSetValue TlsFree AcquireSRWLockExclusive CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetSystemDirectoryW GetWindowsDirectoryW ProcessIdToSessionId QueryFullProcessImageNameW WTSGetActiveConsoleSessionId EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead RtlPcToFileHeader RtlUnwindEx GetFullPathNameW SetStdHandle GetFileType GetConsoleOutputCP GetConsoleMode SetConsoleCtrlHandler ExitProcess GetStdHandle WriteConsoleW HeapAlloc HeapFree GetDriveTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc GetTimeZoneInformation HeapSize IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap LocalFree UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateEventW WaitForSingleObject ResetEvent SetEvent SetLastError MoveFileExW MoveFileW CopyFileW GetTempPathW GetTempFileNameW DeleteFileW SetErrorMode DeleteCriticalSection InitializeCriticalSectionEx RaiseException DecodePointer FlushFileBuffers GetLastError CreatePipe

advapi32

CheckTokenMembership SystemFunction036 ConvertSidToStringSidW GetTokenInformation OpenProcessToken RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey AllocateAndInitializeSid RegisterServiceCtrlHandlerW SetServiceStatus StartServiceCtrlDispatcherW ConvertStringSecurityDescriptorToSecurityDescriptorW FreeSid GetUserNameW ChangeServiceConfigW ChangeServiceConfig2W CloseServiceHandle ControlService CreateServiceW DeleteService OpenSCManagerW OpenServiceW QueryServiceStatus StartServiceW DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf

user32

PeekMessageW MsgWaitForMultipleObjectsEx PostMessageW PostQuitMessage GetQueueStatus SetTimer KillTimer DefWindowProcW RegisterClassExW GetWindowLongPtrW SetWindowLongPtrW DispatchMessageW TranslateMessage MonitorFromWindow CharUpperW UnregisterClassW LoadIconW CreateWindowExW DestroyWindow SetWindowPos SetForegroundWindow AllowSetForegroundWindow GetClientRect GetWindowRect MapWindowPoints GetWindowLongW GetParent GetWindow GetMonitorInfoW

shell32

SHGetFolderPathW ShellExecuteExW SHGetKnownFolderPath CommandLineToArgvW

winmm

timeBeginPeriod timeEndPeriod timeGetTime

ole32

CoInitializeEx CoUninitialize CoTaskMemFree

crypt32

CertNameToStrW

shlwapi

PathMatchSpecW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateSessionsW

dbghelp

SymSetOptions SymCleanup SymGetLineFromAddr64 SymInitialize SymFromAddr UnDecorateSymbolName

Name

.text

Size

720KB

Virtual Size

719KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

235KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

401KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_38656f5d9081586783f4ac4e2abda404_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

advapi32

user32

shell32

winmm

ole32

crypt32

shlwapi

wtsapi32

dbghelp

generic