2026-10-22_6840bfdd23d0c9246073580fa46ddc1c_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_6840bfdd23d0c9246073580fa46ddc1c_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 2.6MB
Sample261024-mbp4cahs5y
SHA256 8a3c9b4767b5625665e7e1e027461d248f4062a17472b5babc77b7740f1f1517
MD5 6840bfdd23d0c9246073580fa46ddc1c
SHA1 f9aaecc1b8fa7e1e4b39fa727ade10dd1ba8423e
SHA512 56326f405546f9a44eda866d9b3be1644cc8460367fd2816bf5ac44c5c70ca891cd63d7badf30095aac38197a3e0a2abf4ae6a6390972f28824668f92734f40d
SSDEEP 49152:K5AlTWOocGdDOxL9TXyTtsBP/OlsLzFmNfW6FJKxxfZA4X:KDe1XzBP/OlsLzFmNfW6FJKxxfZA4X
TLSH
T1B2C5E4DA7E5072F2D19CD8387857727DD6637C396E234A8F2297FF1E1A37260492A102
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_6840bfdd23d0c9246073580fa46ddc1c_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-10-22_6840bfdd23d0c9246073580fa46ddc1c_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 2.6MB

2026-10-22_6840bfdd23d0c9246073580fa46ddc1c_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH e2bc7e072aa286d4cd7c33f1209679b0
SHA256 8a3c9b4767b5625665e7e1e027461d248f4062a17472b5babc77b7740f1f1517
MD5 6840bfdd23d0c9246073580fa46ddc1c
SHA1 f9aaecc1b8fa7e1e4b39fa727ade10dd1ba8423e
SHA512 56326f405546f9a44eda866d9b3be1644cc8460367fd2816bf5ac44c5c70ca891cd63d7badf30095aac38197a3e0a2abf4ae6a6390972f28824668f92734f40d
SSDEEP 49152:K5AlTWOocGdDOxL9TXyTtsBP/OlsLzFmNfW6FJKxxfZA4X:KDe1XzBP/OlsLzFmNfW6FJKxxfZA4X
TLSH
T1B2C5E4DA7E5072F2D19CD8387857727DD6637C396E234A8F2297FF1E1A37260492A102
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2625536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetVolumePathNameW ReadFile RemoveDirectoryW SetFileAttributesW SetFileInformationByHandle SetFilePointer GetCompressedFileSizeW FindFirstFileNameW IsDebuggerPresent SetHandleInformation CreatePipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus DeviceIoControl IsWow64Process LoadLibraryExW ReadDirectoryChangesW CreateSymbolicLinkW CompareStringOrdinal GetUserGeoID CreateToolhelp32Snapshot Process32FirstW Process32NextW GetPrivateProfileStringW WritePrivateProfileStringW CopyFileW MoveFileExW ReplaceFileW GetComputerNameW RegisterApplicationRestart GetFileInformationByHandleEx OpenFileById GetDllDirectoryW FormatMessageW WriteConsoleW ReadConsoleW SetEndOfFile GetConsoleMode GetConsoleOutputCP GetFileInformationByHandle SetFilePointerEx SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindNextFileW FindFirstFileExW GetOEMCP GetFileAttributesExW GetFileAttributesW GetDiskFreeSpaceExW FindVolumeClose FindNextVolumeW FindFirstVolumeW CreateFileW CreateDirectoryW SetThreadInformation GetSystemTimes SetProcessShutdownParameters GetExitCodeProcess GetProcessTimes WaitForMultipleObjects CreateEventW ReleaseMutex GetLongPathNameW SetLastError VerifyVersionInfoW GetProductInfo VerSetConditionMask ExpandEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW K32GetModuleFileNameExW GetUserDefaultLCID LCIDToLocaleName SystemTimeToFileTime MoveFileW LocalAlloc GetModuleFileNameW GetVersionExW GetSystemTimeAsFileTime GetSystemTime OpenProcess TerminateProcess GetCurrentProcess CreateMutexW WaitForSingleObject GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc FindFirstFileW FindClose DeleteFileW LCMapStringW WideCharToMultiByte MultiByteToWideChar CloseHandle CreateProcessW GetCurrentProcessId FreeLibrary InitializeCriticalSectionEx GetProcAddress LoadLibraryW SetDllDirectoryW Sleep LocalFree GetACP IsValidCodePage GetTimeZoneInformation EnumSystemLocalesW IsValidLocale GetLocaleInfoW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc WriteFile GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx InitializeSListHead DeleteCriticalSection DecodePointer GetLastError FlushFileBuffers GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleW WaitForSingleObjectEx ResetEvent SetEvent InitializeCriticalSectionAndSpinCount GetCPInfo CompareStringEx LCMapStringEx EncodePointer GetLocaleInfoEx GetStringTypeW LeaveCriticalSection EnterCriticalSection RaiseException OutputDebugStringW

user32

DispatchMessageW PostMessageW EnumWindows GetClassNameW GetWindowThreadProcessId SystemParametersInfoW SendMessageTimeoutW GetMessageW TranslateMessage CreateWindowExW ShowWindow DestroyWindow RegisterClassW UnregisterPowerSettingNotification RegisterPowerSettingNotification

advapi32

SetNamedSecurityInfoW AdjustTokenPrivileges CreateProcessWithTokenW GetUserNameW SetFileSecurityW ConvertSidToStringSidW GetNamedSecurityInfoW SetEntriesInAclW StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatusEx QueryServiceStatus QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegDeleteTreeW RegUnLoadKeyW RegLoadKeyW RegEnumKeyW RegDeleteKeyExW RegCreateKeyTransactedW GetAclInformation FreeSid DuplicateTokenEx CreateWellKnownSid AllocateAndInitializeSid CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorW CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW RegGetValueW RegSetKeyValueW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumValueW RegEnumKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW GetTokenInformation OpenProcessToken

shell32

ShellExecuteExW SHCreateItemFromParsingName SHAssocEnumHandlers SHCreateDirectoryExW SHGetFolderPathW SHGetFolderPathAndSubDirW SHSetKnownFolderPath CommandLineToArgvW SHChangeNotify SHFileOperationW SHGetSpecialFolderPathW SHGetKnownFolderPath SHParseDisplayName ord526

ole32

CoInitialize CoInitializeSecurity CoUninitialize StringFromCLSID CoTaskMemFree CoCreateInstance StringFromGUID2 CreateBindCtx CoCreateGuid CoInitializeEx CoCreateFreeThreadedMarshaler CoSetProxyBlanket CreateItemMoniker GetRunningObjectTable

oleaut32

SysAllocString GetErrorInfo SetErrorInfo SysStringLen SysFreeString LoadTypeLi LoadRegTypeLi GetRecordInfoFromTypeInfo

crypt32

CryptBinaryToStringW CryptStringToBinaryW CertFindExtension

rpcrt4

RpcBindingFromStringBindingW RpcBindingVectorFree RpcStringBindingComposeW RpcStringFreeW RpcServerInqBindings RpcServerRegisterIfEx RpcServerUnregisterIf RpcServerUseProtseqW RpcBindingSetAuthInfoExW RpcEpRegisterW RpcEpUnregister RpcServerInqCallAttributesW RpcBindingFree

secur32

GetUserNameExW

shlwapi

PathIsDirectoryW PathFileExistsW PathStripPathW SHDeleteValueW SHDeleteKeyW PathIsPrefixW SHRegGetUSValueW PathIsDirectoryEmptyW PathRemoveFileSpecW StrStrIW SHCreateStreamOnFileW AssocQueryStringW SHRegGetBoolUSValueW SHRegGetPathW SHRegGetValueW SHSetValueW SHGetValueA SHGetValueW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

wininet

InternetCanonicalizeUrlW InternetCheckConnectionW

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

userenv

CreateEnvironmentBlock GetDefaultUserProfileDirectoryW

Name

.text

Size

656KB

Virtual Size

656KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

196KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcdatah

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_6840bfdd23d0c9246073580fa46ddc1c_cobalt-strike_icedid_njrat_satacom_stealc_vidar

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

rpcrt4

secur32

shlwapi

version

wininet

wtsapi32

userenv

generic