2026-10-21_955f7b693a85e75ac304a3943ca247f6_cobalt-strike_icedid_satacom_stealc_vidar

General

Target
2026-10-21_955f7b693a85e75ac304a3943ca247f6_cobalt-strike_icedid_satacom_stealc_vidar
Size 2.5MB
Sample261022-vac2dsag62
SHA256 cb00c308d28e3fc671b3623989253b41474605cbac10a9ad286ec67642ea41f6
MD5 955f7b693a85e75ac304a3943ca247f6
SHA1 a4adc5eb82afa5627dab1e77c725406c44edd1d9
SHA512 745bf536bd9a581234edddf1091d56a5cb90ae9cfc85de073448eaf601fd0c6a895f0c61a912b6af7d8d9db59a86b0ed95e02e2bbcaba4d673aad845ed8634d3
SSDEEP 49152:IGWsRCxn2XwPygZuPvNRijqKOFmwPkEC:fJgnTNYXNsqJowPk
TLSH
T1A4C5D017915A18FED143A4F6990ECA805794B6CB0B71DCDF079192B23FA9FA00B6FD21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-21_955f7b693a85e75ac304a3943ca247f6_cobalt-strike_icedid_satacom_stealc_vidar

File Explorer

2026-10-21_955f7b693a85e75ac304a3943ca247f6_cobalt-strike_icedid_satacom_stealc_vidar

.exe 2.5MB

2026-10-21_955f7b693a85e75ac304a3943ca247f6_cobalt-strike_icedid_satacom_stealc_vidar

IMPHASH ffede544e43ad9518cba724c90a5d0ab
SHA256 cb00c308d28e3fc671b3623989253b41474605cbac10a9ad286ec67642ea41f6
MD5 955f7b693a85e75ac304a3943ca247f6
SHA1 a4adc5eb82afa5627dab1e77c725406c44edd1d9
SHA512 745bf536bd9a581234edddf1091d56a5cb90ae9cfc85de073448eaf601fd0c6a895f0c61a912b6af7d8d9db59a86b0ed95e02e2bbcaba4d673aad845ed8634d3
SSDEEP 49152:IGWsRCxn2XwPygZuPvNRijqKOFmwPkEC:fJgnTNYXNsqJowPk
TLSH
T1A4C5D017915A18FED143A4F6990ECA805794B6CB0B71DCDF079192B23FA9FA00B6FD21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

452556

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer DecodePointer InitializeCriticalSectionEx MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo SetEndOfFile RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadFile ReadConsoleW FlushFileBuffers FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapReAlloc HeapSize CreateFileW WriteConsoleW RtlUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-21_955f7b693a85e75ac304a3943ca247f6_cobalt-strike_icedid_satacom_stealc_vidar

kernel32

generic