2026-10-26_890a952c4008f67cb244af877cc64069_cobalt-strike_icedid_njrat_satacom_stealc_vidar

General

Target
2026-10-26_890a952c4008f67cb244af877cc64069_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 3.7MB
Sample261027-prjmlsde75
SHA256 9a9e1c1c1983121e9a70093ae7c547828c06a4bbfe61f98c198ab484fda0d5cf
MD5 890a952c4008f67cb244af877cc64069
SHA1 8857a27e5f23e4c76bc878397f61696b3cdc9308
SHA512 b2c0e8b4178b91097fdbfe118afdfc011316acbcc833f82e1a6d89eb4cfd5861bbbab3a026debeeb2f00c57e7af68aac4a8007c8d1ffb3d48239859e2e3c379c
SSDEEP 49152:v2wFZ58M+xZwOVqMOe6tz5XtF7skRbIFKe/bcvYNDioZVYFrp4YXxbuwETLZ8tYt:5O3wKQ5xzR0FKe/5KF9TETLZUY
TLSH
T1D306AF46E29B0BE4F252C23A85564207E775701E8B32BFDF4295CD242E336F51E7E2A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_890a952c4008f67cb244af877cc64069_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-10-26_890a952c4008f67cb244af877cc64069_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 3.7MB

2026-10-26_890a952c4008f67cb244af877cc64069_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH 47d52a9b47c7c8f43f51d884a33dbec1
SHA256 9a9e1c1c1983121e9a70093ae7c547828c06a4bbfe61f98c198ab484fda0d5cf
MD5 890a952c4008f67cb244af877cc64069
SHA1 8857a27e5f23e4c76bc878397f61696b3cdc9308
SHA512 b2c0e8b4178b91097fdbfe118afdfc011316acbcc833f82e1a6d89eb4cfd5861bbbab3a026debeeb2f00c57e7af68aac4a8007c8d1ffb3d48239859e2e3c379c
SSDEEP 49152:v2wFZ58M+xZwOVqMOe6tz5XtF7skRbIFKe/bcvYNDioZVYFrp4YXxbuwETLZ8tYt:5O3wKQ5xzR0FKe/5KF9TETLZUY
TLSH
T1D306AF46E29B0BE4F252C23A85564207E775701E8B32BFDF4295CD242E336F51E7E2A1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1575600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegEnumValueA RegOpenKeyExA RegCloseKey

shell32

CommandLineToArgvW SHGetFolderPathA

kernel32

GetFileTime GetFileAttributesA FindNextFileA GetStdHandle GetCommandLineW GetFileType LocalFree WriteConsoleW CloseHandle GetWindowsDirectoryA GetVersionExA GetModuleFileNameA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetCurrentThreadId WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EncodePointer DecodePointer CompareStringEx MultiByteToWideChar GetCPInfo LCMapStringEx GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW FindFirstFileA RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleFileNameW GetModuleHandleExW ReadFile WriteFile ExitProcess GetCommandLineA HeapAlloc HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx OutputDebugStringW HeapReAlloc FlushFileBuffers ReadConsoleW SetStdHandle DeleteFileW GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap CreateFileW HeapSize SetEndOfFile CreateFileA GetFullPathNameA

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

61KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

616KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_890a952c4008f67cb244af877cc64069_cobalt-strike_icedid_njrat_satacom_stealc_vidar

advapi32

shell32

kernel32

generic