2026-10-10_4ef8b6b1c305dfbf71c0714f7e1d0fe7_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-10-10_4ef8b6b1c305dfbf71c0714f7e1d0fe7_cobalt-strike_icedid_njrat_satacom_vidar
Size 206KB
Sample261011-rtbqwsbx2n
SHA256 352c83a6a978cbc4fc5f0034a9290e46765b4258dfd69a002222e54ebc1994b5
MD5 4ef8b6b1c305dfbf71c0714f7e1d0fe7
SHA1 db439a11dee99b1c2eb1be4f539edf8257674b73
SHA512 032ef7d91c555a2016cae0bf661f5b419597ead38ab78354fd23ee9a47b7ff16e0d2cd8facec15a17f66d1cb545da4ced720695f9faefc2a863da2e7241c4224
SSDEEP 3072:bVSJROCb90n83Zh2tF01G+HC2w4ge9qzBk603MjV+Afzmq:5S7d90nonme11w4aPrm
TLSH
T11A244B4A73E408F9E5778239C9614A06D67778550720CBEF17A0437A9F237D0AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_4ef8b6b1c305dfbf71c0714f7e1d0fe7_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-10-10_4ef8b6b1c305dfbf71c0714f7e1d0fe7_cobalt-strike_icedid_njrat_satacom_vidar

.exe 206KB

2026-10-10_4ef8b6b1c305dfbf71c0714f7e1d0fe7_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 72a98daaf917c10140b507e53ece38db
SHA256 352c83a6a978cbc4fc5f0034a9290e46765b4258dfd69a002222e54ebc1994b5
MD5 4ef8b6b1c305dfbf71c0714f7e1d0fe7
SHA1 db439a11dee99b1c2eb1be4f539edf8257674b73
SHA512 032ef7d91c555a2016cae0bf661f5b419597ead38ab78354fd23ee9a47b7ff16e0d2cd8facec15a17f66d1cb545da4ced720695f9faefc2a863da2e7241c4224
SSDEEP 3072:bVSJROCb90n83Zh2tF01G+HC2w4ge9qzBk603MjV+Afzmq:5S7d90nonme11w4aPrm
TLSH
T11A244B4A73E408F9E5778239C9614A06D67778550720CBEF17A0437A9F237D0AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

45088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

ord412 ord413 ord410

winmm

midiInReset midiInStop midiInStart midiInAddBuffer midiInGetNumDevs midiInPrepareHeader midiInClose midiInOpen midiInGetDevCapsW midiInUnprepareHeader

user32

PostMessageA GetWindowTextW SetActiveWindow KillTimer GetFocus IsWindowVisible ShowWindow IsChild IsWindow CreateWindowExW PeekMessageW DispatchMessageW TranslateMDISysAccel IsDialogMessageW GetParent SetWindowLongPtrW GetWindowLongPtrW SendMessageW SetTimer SetFocus GetDlgItem CreateDialogIndirectParamW DestroyWindow GetWindowRect

kernel32

HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetFileSizeEx LCMapStringW CompareStringW GetStringTypeW HeapFree HeapAlloc OutputDebugStringW GetCommandLineW GetCommandLineA ExitProcess WriteFile GetCPInfo WriteConsoleW GetLastError SetLastError GetCurrentThreadId GetModuleHandleW GlobalFree InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GlobalAlloc GlobalUnlock GlobalLock FreeLibrary LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW LocalFree FormatMessageA CreateFileW FindClose FindFirstFileExW FindNextFileW SetFilePointerEx AreFileApisANSI CloseHandle MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetSystemTimeAsFileTime GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleExW RtlPcToFileHeader RaiseException RtlUnwindEx EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle GetFileType GetModuleFileNameW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_4ef8b6b1c305dfbf71c0714f7e1d0fe7_cobalt-strike_icedid_njrat_satacom_vidar

comctl32

winmm

user32

kernel32

generic