2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.7MB
Sample261012-v1lffsyvbz
SHA256 b47f52bdc17b0097133df631716915bcf2868b75c5225cef8776c53d52aae0d9
MD5 8202d186100671001524d9628cdd7e58
SHA1 bf49629b9e4fb3ef561b621378667206ddcda358
SHA512 6483243b762afb285e7ce91cfdfb9ff1656ecbb9583627970c0a4c0eaec5bfadd8e8e210d5a95e8862b8b6d4c344d4f39c56e1c0d0797c632ae4dfc78dc601e5
SSDEEP 24576:bR4JEys6kT0Bhvn/+h1Ay+4ZAgayjhwbmY3MaReFeDvSP3b:SqynTBh34z+tgauhwbR3P8wT8
TLSH
T14F85024463D80CF8E977823DC9A24A12E6727C524B30D75F57A1275B9F33AA0DE3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.7MB

2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 6aed8a1d48749f3ad36c3c72bcf9aeb1
SHA256 b47f52bdc17b0097133df631716915bcf2868b75c5225cef8776c53d52aae0d9
MD5 8202d186100671001524d9628cdd7e58
SHA1 bf49629b9e4fb3ef561b621378667206ddcda358
SHA512 6483243b762afb285e7ce91cfdfb9ff1656ecbb9583627970c0a4c0eaec5bfadd8e8e210d5a95e8862b8b6d4c344d4f39c56e1c0d0797c632ae4dfc78dc601e5
SSDEEP 24576:bR4JEys6kT0Bhvn/+h1Ay+4ZAgayjhwbmY3MaReFeDvSP3b:SqynTBh34z+tgauhwbR3P8wT8
TLSH
T14F85024463D80CF8E977823DC9A24A12E6727C524B30D75F57A1275B9F33AA0DE3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

53104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\WinRAR\uninstall\build\uninstall64\Release\uninstall.pdb

kernel32

FindClose FindFirstFileW FindNextFileW GetVersionExW GetCurrentDirectoryW FindResourceW FreeLibrary LoadLibraryExW LoadLibraryW GetProcAddress GetSystemDirectoryW GetModuleHandleW CompareStringW MultiByteToWideChar WideCharToMultiByte GetCPInfo IsDBCSLeadByte GetModuleHandleExW GetShortPathNameW GetTempPathW Sleep SetCurrentDirectoryW GetCommandLineW GetEnvironmentVariableW CreateProcessW CopyFileW MoveFileExW SetStdHandle MoveFileW GetProcessHeap LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP HeapAlloc HeapFree ExitProcess QueryPerformanceFrequency TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RtlUnwindEx RaiseException RtlPcToFileHeader LocalFree InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW GetCurrentProcessId SetFileAttributesW RemoveDirectoryW GetDiskFreeSpaceExW WriteFile SetFileTime SetFilePointer SetEndOfFile ReadFile GetFileType FlushFileBuffers CreateFileW ExpandEnvironmentStringsW GetStdHandle SetLastError GetLastError GetModuleFileNameW WaitForSingleObject CloseHandle GetFileAttributesW DeleteFileW CreateDirectoryW GetStringTypeW ReadConsoleW HeapSize WriteConsoleW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

user32

SetWindowTextW InvalidateRect EnableWindow ShowWindow SendMessageW GetParent DialogBoxParamW GetDlgItem EndDialog LoadIconW GetSysColor SetForegroundWindow SendDlgItemMessageW MessageBoxW GetDesktopWindow ReleaseDC GetDC IsWindowVisible IsWindow CharUpperW LoadStringW GetWindow GetClassNameW SetProcessDefaultLayout GetWindowLongPtrW SetWindowLongW GetWindowLongW GetWindowRect GetClientRect GetSystemMetrics SetWindowPos OemToCharA IsDlgButtonChecked CheckDlgButton GetDlgItemTextW SetDlgItemTextW

gdi32

CreateFontW GetDeviceCaps DeleteObject

advapi32

RegCreateKeyExW RegSetValueExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyExW RegDeleteKeyW RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

SHFileOperationW ShellExecuteExW SHGetFolderPathW SHChangeNotify ShellExecuteW SHGetMalloc SHGetPathFromIDListW SHGetSpecialFolderLocation

ole32

OleUninitialize OleInitialize CoCreateInstance CoSetProxyBlanket

oleaut32

SysAllocString SysFreeString VariantClear

Name

.text

Size

158KB

Virtual Size

157KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

181KB

Virtual Size

181KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_8202d186100671001524d9628cdd7e58_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic