2026-10-22_3761f578fadb1f8ca6e67a7ec2dac478_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_3761f578fadb1f8ca6e67a7ec2dac478_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.4MB
Sample261024-t7vr2acx8k
SHA256 d8c6871136d9281184a9736f98bff8affd67890aff47fd3aaac30e997b6df82b
MD5 3761f578fadb1f8ca6e67a7ec2dac478
SHA1 e9c5c56297757aa28d8e68b58d5d6a4619544e8e
SHA512 2e544d256cd8f36acdc8ead9beb8aef54ea567c5b85ddcf0241c094ef9b86a137d92252dc8cbaeb4b85065fa3478a06379873aa6332fbccf975a8d9f60367579
SSDEEP 24576:zvQiW8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bQiW8LNiXicJFFRGNzj3
TLSH
T141650157B39520F5E2BA8138C8614415F3B27C354B218BDF03A4667E6E37BE19E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_3761f578fadb1f8ca6e67a7ec2dac478_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-10-22_3761f578fadb1f8ca6e67a7ec2dac478_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.4MB

2026-10-22_3761f578fadb1f8ca6e67a7ec2dac478_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH f8c279f7295f8cf39454604579b44024
SHA256 d8c6871136d9281184a9736f98bff8affd67890aff47fd3aaac30e997b6df82b
MD5 3761f578fadb1f8ca6e67a7ec2dac478
SHA1 e9c5c56297757aa28d8e68b58d5d6a4619544e8e
SHA512 2e544d256cd8f36acdc8ead9beb8aef54ea567c5b85ddcf0241c094ef9b86a137d92252dc8cbaeb4b85065fa3478a06379873aa6332fbccf975a8d9f60367579
SSDEEP 24576:zvQiW8/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:bQiW8LNiXicJFFRGNzj3
TLSH
T141650157B39520F5E2BA8138C8614415F3B27C354B218BDF03A4667E6E37BE19E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Jenkins\workspace\LenovoMis-105-136-154-pipeline\HDRFP-10229\sw\niseWrappers\wbf\SynUwpService\Server\x64\Release\SynRpcServer.pdb

rpcrt4

NdrServerCallAll NdrServerCall2 RpcBindingVectorFree RpcEpUnregister RpcServerUnregisterIf RpcServerListen RpcEpRegisterW RpcServerInqBindings RpcServerRegisterIf3 RpcServerUseProtseqEpW

api-ms-win-core-errorhandling-l1-1-0

RaiseException SetUnhandledExceptionFilter SetLastError GetLastError UnhandledExceptionFilter

api-ms-win-core-synch-l1-1-0

EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

api-ms-win-security-base-l1-1-0

CopySid InitializeSecurityDescriptor AllocateAndInitializeSid SetSecurityDescriptorDacl GetLengthSid FreeSid

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolWork SubmitThreadpoolWork

api-ms-win-service-core-l1-1-0

SetServiceStatus StartServiceCtrlDispatcherW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus ControlService RegisterServiceCtrlHandlerW

api-ms-win-eventing-provider-l1-1-0

EventUnregister EventRegister EventWriteString

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW FreeLibrary GetProcAddress GetModuleFileNameW GetModuleHandleW GetModuleHandleExW

api-ms-win-service-management-l1-1-0

CloseServiceHandle CreateServiceW OpenSCManagerW DeleteService OpenServiceW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW RegQueryValueExW RegCloseKey RegSetValueExW

winbio

WinBioFree WinBioLockUnit WinBioEnumBiometricUnits WinBioCloseSession WinBioControlUnitPrivileged WinBioUnlockUnit WinBioDeleteTemplate WinBioOpenSession

api-ms-win-core-rtlsupport-l1-1-0

RtlUnwindEx RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext RtlPcToFileHeader

api-ms-win-core-processthreads-l1-1-0

TlsFree TlsSetValue GetCurrentProcessId GetCurrentThreadId TlsGetValue GetCurrentProcess TlsAlloc GetStartupInfoW ExitProcess TerminateProcess

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-processenvironment-l1-1-0

SetStdHandle FreeEnvironmentStringsW GetCommandLineW SetEnvironmentVariableW GetStdHandle GetCommandLineA GetEnvironmentStringsW

api-ms-win-core-file-l1-1-0

FindNextFileW FindFirstFileExW FindClose SetFilePointerEx GetFileSizeEx GetFileType CreateFileW FlushFileBuffers WriteFile

api-ms-win-core-heap-l1-1-0

HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap

api-ms-win-core-string-l1-1-0

WideCharToMultiByte GetStringTypeW MultiByteToWideChar CompareStringW

api-ms-win-core-localization-l1-2-0

LCMapStringW GetACP GetOEMCP GetCPInfo IsValidCodePage

api-ms-win-core-console-l1-1-0

GetConsoleOutputCP GetConsoleMode WriteConsoleW

api-ms-win-core-handle-l1-1-0

CloseHandle

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_3761f578fadb1f8ca6e67a7ec2dac478_cobalt-strike_icedid_njrat_satacom_vidar

rpcrt4

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-2-2

api-ms-win-security-base-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-service-core-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-registry-l1-1-0

winbio

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-handle-l1-1-0

generic