2026-10-19_5a644256a3bfae2459635aa9657dcf22_cobalt-strike_icedid_satacom_stealc_vidar

General

Target
2026-10-19_5a644256a3bfae2459635aa9657dcf22_cobalt-strike_icedid_satacom_stealc_vidar
Size 981KB
Sample261020-x9areshv3m
SHA256 8637162b55b51a418b8e1a80b1985fc8f57d79f0bee61b080ced52c695d748b8
MD5 5a644256a3bfae2459635aa9657dcf22
SHA1 cc15ad47b2924910df18108a8906ae0f7b4aaf66
SHA512 35eb03a13b2d39d2709aa42253a1ae5e55b87844bc63db58c3659e96a8f7b0e6ec7fd3b530917164ea9b29f57b238dfb6b6b0898d430e5c9790332683b100baa
SSDEEP 12288:gWvAivSuYllW9138215s6a24/0H1E7S4RRo5B2kwEFfrlkdN:gWv9vbYfWa2XdI0H1uRa5TnZS
TLSH
T1D825DF1AA76414F9D9A3827CCE468606E7B67C0507619BDF13A0BA5A3F337D08D3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_5a644256a3bfae2459635aa9657dcf22_cobalt-strike_icedid_satacom_stealc_vidar

File Explorer

2026-10-19_5a644256a3bfae2459635aa9657dcf22_cobalt-strike_icedid_satacom_stealc_vidar

.exe 981KB

2026-10-19_5a644256a3bfae2459635aa9657dcf22_cobalt-strike_icedid_satacom_stealc_vidar

IMPHASH 18f462e23828324bd4f5429647f6100f
SHA256 8637162b55b51a418b8e1a80b1985fc8f57d79f0bee61b080ced52c695d748b8
MD5 5a644256a3bfae2459635aa9657dcf22
SHA1 cc15ad47b2924910df18108a8906ae0f7b4aaf66
SHA512 35eb03a13b2d39d2709aa42253a1ae5e55b87844bc63db58c3659e96a8f7b0e6ec7fd3b530917164ea9b29f57b238dfb6b6b0898d430e5c9790332683b100baa
SSDEEP 12288:gWvAivSuYllW9138215s6a24/0H1E7S4RRo5B2kwEFfrlkdN:gWv9vbYfWa2XdI0H1uRa5TnZS
TLSH
T1D825DF1AA76414F9D9A3827CCE468606E7B67C0507619BDF13A0BA5A3F337D08D3E760
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

112744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MessageBoxA

kernel32

VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameW GetModuleHandleW CreateRemoteThread FormatMessageA SetEnvironmentVariableA SetEnvironmentVariableW GetCurrentProcessId TerminateProcess ResumeThread CreateProcessW WriteConsoleW WaitForSingleObject SetLastError GetLastError CloseHandle SetEndOfFile LoadLibraryW LocalFree GetLocaleInfoEx QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW AreFileApisANSI GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlUnwind GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW ExitProcess GetStdHandle WriteFile HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle HeapSize

advapi32

RegQueryValueExW RegOpenKeyExW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegSetValueExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_5a644256a3bfae2459635aa9657dcf22_cobalt-strike_icedid_satacom_stealc_vidar

user32

kernel32

advapi32

generic