2026-10-25_b482deb804b3eee508f6c6f3054a4b14_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-25_b482deb804b3eee508f6c6f3054a4b14_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 409KB
Sample261026-sphjbatw2j
SHA256 63feb615f7996675e8f46c48d65483e15fbf6efa4881dfd345ca56f3ead922dc
MD5 b482deb804b3eee508f6c6f3054a4b14
SHA1 db4a4fc2d2ce21bbcdd42818d2342503147b5be6
SHA512 8d559095f723e46c13cd7f663e807acd750a15921decf637820e28dbdfa63a61467539d04e64452da45a3379498f63e707e49bc9f08f2afedea7be72075552c5
SSDEEP 6144:qd8NgZ8aRmSplU9yitKq/dMW2DwHW2yiSwCQlKBxhd+pZQOx/L8:SHk95KG6wHwsFKBbIpuQ
TLSH
T1B5947A09A2E404F9E2B7F17899B36916F6727C090720A9DF13D0495A1F77BE0A13F762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-25_b482deb804b3eee508f6c6f3054a4b14_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-10-25_b482deb804b3eee508f6c6f3054a4b14_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 409KB

2026-10-25_b482deb804b3eee508f6c6f3054a4b14_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH 4a108c8cbbb9b5f7e8dc17b18d3fee12
SHA256 63feb615f7996675e8f46c48d65483e15fbf6efa4881dfd345ca56f3ead922dc
MD5 b482deb804b3eee508f6c6f3054a4b14
SHA1 db4a4fc2d2ce21bbcdd42818d2342503147b5be6
SHA512 8d559095f723e46c13cd7f663e807acd750a15921decf637820e28dbdfa63a61467539d04e64452da45a3379498f63e707e49bc9f08f2afedea7be72075552c5
SSDEEP 6144:qd8NgZ8aRmSplU9yitKq/dMW2DwHW2yiSwCQlKBxhd+pZQOx/L8:SHk95KG6wHwsFKBbIpuQ
TLSH
T1B5947A09A2E404F9E2B7F17899B36916F6727C090720A9DF13D0495A1F77BE0A13F762
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

29712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\fifo\Downloads\EC\EC - EasyCheat injector\fortnite injector\Injector\x64\Release\EC-EasyCheat-Injector-v3.pdb

kernel32

GetLastError DeleteFileA DeleteFileW CloseHandle SetFileAttributesW RemoveDirectoryA CreateProcessA GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime GetFileAttributesW CreateFileW WaitForSingleObject GetTempPathW MoveFileExW WriteFile InitializeSListHead SetUnhandledExceptionFilter GetModuleHandleW LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW GetFileAttributesExW CreateFile2 AreFileApisANSI GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter

user32

MessageBoxW

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

SHCreateDirectoryExW

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetOpenUrlA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception __C_specific_handler __std_terminate __std_exception_copy __std_exception_destroy memmove memset _CxxThrowException memcpy

api-ms-win-crt-runtime-l1-1-0

terminate exit _crt_atexit _register_thread_local_exe_atexit_callback system _cexit __p___argv __p___argc _exit _initterm_e _initterm _get_initial_narrow_environment _register_onexit_function _configure_narrow_argv _c_exit _set_app_type _seh_filter_exe _initialize_onexit_table abort _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

fread fsetpos ungetc _fseeki64 fgetpos fwrite __p__commode _set_fmode setvbuf fgetc fputc fclose fflush _get_stream_buffer_pointers

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-25_b482deb804b3eee508f6c6f3054a4b14_cobalt-strike_icedid_njrat_satacom_stealc_vidar

kernel32

user32

advapi32

shell32

msvcp140

wininet

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic