2026-10-13_0ab09bc7ff8c02baa9be712bb17c2ab9_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-13_0ab09bc7ff8c02baa9be712bb17c2ab9_cobalt-strike_icedid_njrat_satacom_vidar
Size 603KB
Sample261015-yvbkvact7v
SHA256 b72cbc91a2a0668e5100ff6f9cf087de89f95dc2de34dc408445d68fe5f6a018
MD5 0ab09bc7ff8c02baa9be712bb17c2ab9
SHA1 150fe0e3eba90cd221333e94c2ce1a54b1f9c3dd
SHA512 f258a3724aa185f19d62b518454775535624663b81acb2b52bbf1478e225aa73d529e978fb6eb00995076dc926e5a30a54ded2e361a17144ca0023ab053157f1
SSDEEP 12288:L8e05qFxcSrtoUTbq9x7+OzJJWxdq70+skYwEUAGTmZbcmKoyReDF02qAHUyw17G:LF0uxcSrtoUTbq9x7+OzJJWxdq70+skS
TLSH
T156D4395AA2A840E0E1BAD57C8B56D94AE7723C160760E6CF126407536F27BF46F7F320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-13_0ab09bc7ff8c02baa9be712bb17c2ab9_cobalt-strike_icedid_njrat_satacom_vidar

.exe 603KB

2026-10-13_0ab09bc7ff8c02baa9be712bb17c2ab9_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 33303d5e424ddcc9afaacc85e17b2223
SHA256 b72cbc91a2a0668e5100ff6f9cf087de89f95dc2de34dc408445d68fe5f6a018
MD5 0ab09bc7ff8c02baa9be712bb17c2ab9
SHA1 150fe0e3eba90cd221333e94c2ce1a54b1f9c3dd
SHA512 f258a3724aa185f19d62b518454775535624663b81acb2b52bbf1478e225aa73d529e978fb6eb00995076dc926e5a30a54ded2e361a17144ca0023ab053157f1
SSDEEP 12288:L8e05qFxcSrtoUTbq9x7+OzJJWxdq70+skYwEUAGTmZbcmKoyReDF02qAHUyw17G:LF0uxcSrtoUTbq9x7+OzJJWxdq70+skS
TLSH
T156D4395AA2A840E0E1BAD57C8B56D94AE7723C160760E6CF126407536F27BF46F7F320
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

80:42:77:77:84:8b:b6:f1:18:81:bf:fe:f8:bf:f0:3f:13:5d:f2:9b:0c:c9:00:34:9d:87:03:cf:43:07:30:34

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

Chains

Jul 7, 2025

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 7, 2021 - Dec 29, 2040

Subject

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

Serial Number

31:9d:9d:48:1a:b6:f5:e0:92:bc:c5:e3:4f:f7:3c:5b

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2022 - Oct 11, 2025

Subject

CN=Entrust Time Stamping CA - TS2,O=Entrust\, Inc.,C=US

Serial Number

25:bc:2b:f3:29:ca:10:7f:1e:a9:ba:88:85:d4:9d:3b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2021 - Dec 29, 2040

Subject

CN=Entrust Timestamp Authority - TSA2,O=Entrust\, Inc.,C=US

Serial Number

c5:14:f6:c9:51:75:ae:fe:76:01:db:b9:15:19:46:ba

Issuer

CN=Entrust Time Stamping CA - TS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 22, 2025 - Jan 18, 2030

Minor OS version

Major OS version

Entry point

288344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

libcef

cef_shared_process_message_builder_create cef_string_multimap_free cef_string_multimap_alloc cef_get_min_log_level cef_v8value_create_function cef_v8value_create_array_buffer cef_v8value_create_string cef_v8value_create_int cef_v8value_create_bool cef_v8context_get_current_context cef_process_message_create cef_string_multimap_append cef_string_multimap_value cef_string_multimap_key cef_string_multimap_size cef_string_map_append cef_string_map_value cef_string_map_key cef_string_map_size cef_string_list_append cef_string_list_value cef_string_list_size cef_string_map_free cef_string_map_alloc cef_binary_value_create cef_api_hash cef_get_path cef_execute_process cef_string_list_free cef_string_list_alloc cef_string_userfree_utf16_free cef_log cef_string_utf16_to_utf8 cef_string_utf8_to_utf16 cef_string_utf16_cmp cef_string_utf16_clear cef_string_utf8_clear cef_string_utf16_set

kernel32

RtlUnwind HeapSize CreateFileW GetProcessHeap SetStdHandle SetEndOfFile CloseHandle WaitForSingleObject GetCurrentProcessId ExitProcess OpenProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW GetTempPathW GetLastError SetLastError FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW HeapFree HeapAlloc GetModuleFileNameW WriteFile GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW GetProcAddress GetModuleHandleW GetSystemTimeAsFileTime LCMapStringEx MultiByteToWideChar DecodePointer EncodePointer QueryPerformanceCounter DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection WriteConsoleW EnterCriticalSection WideCharToMultiByte GetCurrentThreadId

Name

.text

Size

431KB

Virtual Size

430KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

121KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-13_0ab09bc7ff8c02baa9be712bb17c2ab9_cobalt-strike_icedid_njrat_satacom_vidar

libcef

kernel32

generic