2026-10-27_ec120df6b83f1adc768e0f68865c5907_cobalt-strike_icedid_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-27_ec120df6b83f1adc768e0f68865c5907_cobalt-strike_icedid_satacom_vidar
Size 11.3MB
Sample261027-215mnaef74
SHA256 fcb32b73d1f581cf0502d8ea185e6c003ebd78133b9dea4d91e868b0ee924111
MD5 ec120df6b83f1adc768e0f68865c5907
SHA1 89805621bbbb5afb229ddb1e5f6a060930056bf4
SHA512 4e1e517d46e25818ae8e6e433575ea4a9aa5b7be400ca29a330f2814c221100036a93caf7c5554b26491f96f0a0bc2eb57d5cd46722a12092314351cd922ebd3
SSDEEP 196608:FGaxDhTfxMCv9S0EHu2eT05xyuEopgB9J5kGRw2aSexhJHblfeWmdeEG0:/DhTJMsJEOvI5Q93DJaGRtaSSJZW/d
TLSH
T1E3C6230798C481B4C4D7876067CB42DEA0F2B156C8BD6E3E3DCE8C0265A1D5A56CF7AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-27_ec120df6b83f1adc768e0f68865c5907_cobalt-strike_icedid_satacom_vidar

File Explorer

2026-10-27_ec120df6b83f1adc768e0f68865c5907_cobalt-strike_icedid_satacom_vidar

.exe 11.3MB

2026-10-27_ec120df6b83f1adc768e0f68865c5907_cobalt-strike_icedid_satacom_vidar

IMPHASH 45ca807d1755b94dbaad7ad03d23061e
SHA256 fcb32b73d1f581cf0502d8ea185e6c003ebd78133b9dea4d91e868b0ee924111
MD5 ec120df6b83f1adc768e0f68865c5907
SHA1 89805621bbbb5afb229ddb1e5f6a060930056bf4
SHA512 4e1e517d46e25818ae8e6e433575ea4a9aa5b7be400ca29a330f2814c221100036a93caf7c5554b26491f96f0a0bc2eb57d5cd46722a12092314351cd922ebd3
SSDEEP 196608:FGaxDhTfxMCv9S0EHu2eT05xyuEopgB9J5kGRw2aSexhJHblfeWmdeEG0:/DhTJMsJEOvI5Q93DJaGRtaSSJZW/d
TLSH
T1E3C6230798C481B4C4D7876067CB42DEA0F2B156C8BD6E3E3DCE8C0265A1D5A56CF7AB
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8554906

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

OpenFileMappingA MapViewOfFile CloseHandle OpenEventA SetEvent WriteConsoleW GetLastError WideCharToMultiByte Sleep RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx HeapSize HeapReAlloc CreateFileW HeapAlloc HeapFree ExitProcess GetModuleHandleA LoadLibraryA GetProcAddress

user32

GetMonitorInfoA QueryDisplayConfig EnumDisplayMonitors DisplayConfigGetDeviceInfo GetDisplayConfigBufferSizes

dxva2

DestroyPhysicalMonitors GetNumberOfPhysicalMonitorsFromHMONITOR GetPhysicalMonitorsFromHMONITOR GetCapabilitiesStringLength

Name

.text

Size

107KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CT|

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.p3Y

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.`|-

Size

7.3MB

Virtual Size

7.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-27_ec120df6b83f1adc768e0f68865c5907_cobalt-strike_icedid_satacom_vidar

kernel32

user32

dxva2

generic