2026-10-22_aaaa98ab4b37b757e44806ce871d8da7_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_aaaa98ab4b37b757e44806ce871d8da7_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.6MB
Sample261024-bhe16swt7m
SHA256 b8bfeb27469edfeaac4f11462bd4528aa49756f4d919f72050c104897e9f637b
MD5 aaaa98ab4b37b757e44806ce871d8da7
SHA1 084a731dfc88756d7f8ab60cd42326bd5e40cd78
SHA512 29a0524268e02144718c4034e3020f6e90bc94685b15450db997d2497c04fb967d4ee8edcb4ebe78ad7abdeca17b09c61f77a4993c37a0e3656a8d6d7b3b412b
SSDEEP 24576:IKnJp2mZNTTb1+/91nQ/tbw/2Mkjy6Fr7g0oc:dJpBNTTI7Q/lFTjN4
TLSH
T1A975E11AF7A814F9E1779278CD628506E7727C8E0771DBAF139803561F336A09E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_aaaa98ab4b37b757e44806ce871d8da7_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-10-22_aaaa98ab4b37b757e44806ce871d8da7_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.6MB

2026-10-22_aaaa98ab4b37b757e44806ce871d8da7_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 1322aeb55891caec76975c71b432771f
SHA256 b8bfeb27469edfeaac4f11462bd4528aa49756f4d919f72050c104897e9f637b
MD5 aaaa98ab4b37b757e44806ce871d8da7
SHA1 084a731dfc88756d7f8ab60cd42326bd5e40cd78
SHA512 29a0524268e02144718c4034e3020f6e90bc94685b15450db997d2497c04fb967d4ee8edcb4ebe78ad7abdeca17b09c61f77a4993c37a0e3656a8d6d7b3b412b
SSDEEP 24576:IKnJp2mZNTTb1+/91nQ/tbw/2Mkjy6Fr7g0oc:dJpBNTTI7Q/lFTjN4
TLSH
T1A975E11AF7A814F9E1779278CD628506E7727C8E0771DBAF139803561F336A09E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

129808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\jenkins\workspace\Client.den\Client\Windows\release\bin\X64\Release\CptInstall.pdb

kernel32

LoadLibraryExW LoadLibraryW LocalAlloc CreateToolhelp32Snapshot Process32FirstW Process32NextW GetLocalTime WideCharToMultiByte GetModuleHandleExW ResumeThread InitializeCriticalSectionAndSpinCount FileTimeToLocalFileTime lstrcmpA lstrcpyW FileTimeToSystemTime MultiByteToWideChar GetFileSize CreateFileMappingW MapViewOfFile UnmapViewOfFile OpenFileMappingW FlushViewOfFile GetPrivateProfileIntW GetModuleHandleW WritePrivateProfileStringW QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId SetEvent CreateEventW TerminateThread GetExitCodeThread WriteConsoleW SetEndOfFile SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW SetFilePointerEx GetFileSizeEx GetModuleHandleA FreeLibrary GetVersionExW GetSystemDirectoryW GetSystemInfo TerminateProcess LeaveCriticalSection EnterCriticalSection HeapSize HeapReAlloc CreateDirectoryW OpenProcess GetProcAddress Sleep CopyFileW CreateProcessW GetFullPathNameW GetFileInformationByHandle CreateFileW GetExitCodeProcess MoveFileW GetTempFileNameW GetProcessHeap GetCurrentProcessId DeleteCriticalSection MoveFileExW LocalFree DecodePointer HeapAlloc RaiseException CloseHandle DeleteFileW GetLastError ProcessIdToSessionId GetFileAttributesW WaitForSingleObject FindClose InitializeCriticalSectionEx GetTempPathW GetModuleFileNameW RemoveDirectoryW GetCurrentProcess FindNextFileW GetCommandLineW SetLastError HeapFree FindFirstFileW GetPrivateProfileStringW GetConsoleMode GetConsoleCP GetFileType WriteFile GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread CreateThread ReadFile GetFileAttributesExW TlsFree TlsSetValue TlsGetValue TlsAlloc RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent OutputDebugStringW IsDebuggerPresent GetStringTypeW EncodePointer CompareStringEx GetCPInfo LCMapStringEx

user32

GetSystemMetrics

advapi32

StartServiceW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW DeleteService CreateServiceW ControlService ChangeServiceConfig2W GetTokenInformation SetEntriesInAclW OpenServiceW OpenSCManagerW CloseServiceHandle SetSecurityDescriptorDacl InitializeSecurityDescriptor FreeSid AllocateAndInitializeSid RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey OpenProcessToken

shell32

SHGetKnownFolderPath SHCreateDirectoryExW SHGetFolderPathW SHGetSpecialFolderPathW CommandLineToArgvW ShellExecuteExW

ole32

CoTaskMemFree

shlwapi

PathAppendW PathFileExistsW PathRemoveFileSpecW PathFindFileNameW PathIsRelativeW

psapi

GetProcessImageFileNameA

rpcrt4

RpcBindingFromStringBindingW NdrClientCall3 RpcServerUnregisterIfEx RpcStringBindingComposeW RpcStringFreeW RpcBindingFree

Name

.text

Size

261KB

Virtual Size

261KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_aaaa98ab4b37b757e44806ce871d8da7_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

user32

advapi32

shell32

ole32

shlwapi

psapi

rpcrt4

generic