2026-10-22_09a479f7c76a9b0394a6de44a2f568d8_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_09a479f7c76a9b0394a6de44a2f568d8_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 1.9MB
Sample261024-19t2vasv3k
SHA256 1d42276894d810aed22faf2dd3e51c0cb60e79ead93340e59e55995a64a77ca9
MD5 09a479f7c76a9b0394a6de44a2f568d8
SHA1 43c651aaffe4acf87aa7f56dfe8e761a0c9dc1d8
SHA512 5b4fdf49cba0bbb5e809e685714a4b26c047df1f78c68364ddc6e4e5af669f2fead50a901a6edfc4290b5f06e4deae600a0804fb97caec1df22327895fb091d7
SSDEEP 49152:H6sFRouhbRk1ghHLQUq/KanD7KlhRhJMofnYVQUmAJ:HfW1gQfWMvQUmAJ
TLSH
T14D95BD42AE9BC5E9D17BA17FC6464E02D5BEF601071392CB0B905A753F13AE30D7A392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_09a479f7c76a9b0394a6de44a2f568d8_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-10-22_09a479f7c76a9b0394a6de44a2f568d8_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 1.9MB

2026-10-22_09a479f7c76a9b0394a6de44a2f568d8_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH d3e41bb184d475027bf420ab2433a3c0
SHA256 1d42276894d810aed22faf2dd3e51c0cb60e79ead93340e59e55995a64a77ca9
MD5 09a479f7c76a9b0394a6de44a2f568d8
SHA1 43c651aaffe4acf87aa7f56dfe8e761a0c9dc1d8
SHA512 5b4fdf49cba0bbb5e809e685714a4b26c047df1f78c68364ddc6e4e5af669f2fead50a901a6edfc4290b5f06e4deae600a0804fb97caec1df22327895fb091d7
SSDEEP 49152:H6sFRouhbRk1ghHLQUq/KanD7KlhRhJMofnYVQUmAJ:HfW1gQfWMvQUmAJ
TLSH
T14D95BD42AE9BC5E9D17BA17FC6464E02D5BEF601071392CB0B905A753F13AE30D7A392
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

442448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\gcomp\rel\src\NvContainer\_out\x86_64\release\container\NvContainer.pdb

shlwapi

PathIsRelativeW

kernel32

LocalAlloc LocalFree GetCurrentDirectoryW SetLastError GetErrorMode SetErrorMode FreeLibrary LoadLibraryExW VerSetConditionMask CreateFileW GetFileAttributesW GetFullPathNameW CreateProcessA CreateProcessW GetSystemDirectoryW GetModuleFileNameA GetModuleFileNameW VerifyVersionInfoW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW OutputDebugStringA Sleep GetCurrentThreadId ProcessIdToSessionId GetSystemTime GetSystemTimeAsFileTime CreateTimerQueueTimer DeleteTimerQueueTimer GetModuleHandleExW MoveFileW GetCurrentProcessId Process32FirstW Process32NextW CreateDirectoryW FindCloseChangeNotification FindFirstChangeNotificationW FindNextChangeNotification MultiByteToWideChar WideCharToMultiByte RemoveDirectoryW DeviceIoControl VirtualQuery VirtualProtect GetSystemInfo WriteConsoleW HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage OutputDebugStringW GetStringTypeW HeapReAlloc ReadConsoleW ReadFile SetStdHandle GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetLastError GetProcAddress GetModuleHandleA RemoveVectoredContinueHandler AddVectoredContinueHandler RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetUnhandledExceptionFilter RtlCaptureStackBackTrace GetModuleHandleW OpenProcess RtlUnwind CreateThread WaitForMultipleObjects OpenEventW CreateEventW WaitForSingleObject SetEvent CloseHandle GetCurrentProcess GetProcessTimes SetDefaultDllDirectories LoadLibraryExA CreateToolhelp32Snapshot FormatMessageA SetCurrentDirectoryW FindFirstFileExW GetDiskFreeSpaceExW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW SetEndOfFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime GetTempPathW AreFileApisANSI CreateDirectoryExW CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedPushEntrySList InterlockedFlushSList RtlUnwindEx EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetFileType GetCPInfo GetStdHandle WriteFile GetCurrentThread HeapAlloc HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleCtrlHandler FlushFileBuffers

user32

PostThreadMessageW PeekMessageW GetMessageW LoadStringW ShutdownBlockReasonDestroy ShutdownBlockReasonCreate SetWindowLongPtrW GetWindowLongPtrW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW PostMessageW DispatchMessageW TranslateMessage

shell32

SHGetKnownFolderPath CommandLineToArgvW

ole32

CoTaskMemFree

advapi32

RegisterServiceCtrlHandlerExW RegSetKeyValueW RegOpenKeyExW RegGetValueW RegDeleteValueW GetUserNameW BuildExplicitAccessWithNameW SetSecurityInfo GetSecurityInfo SetEntriesInAclW StartServiceCtrlDispatcherW SetServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW CloseServiceHandle ChangeServiceConfigW RegSetValueExW RegCreateKeyExW RegCloseKey LookupAccountSidW CreateWellKnownSid OpenProcessToken

Name

.text

Size

854KB

Virtual Size

853KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

186KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

760KB

Virtual Size

760KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_09a479f7c76a9b0394a6de44a2f568d8_cobalt-strike_icedid_njrat_satacom_stealc_vidar

shlwapi

kernel32

user32

shell32

ole32

advapi32

generic