2026-10-26_8846201bdb337e014ef45c571db650f1_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_8846201bdb337e014ef45c571db650f1_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.4MB
Sample261027-pvtxratybv
SHA256 07b7a0cae770f1eac6f11f9c5f3af6cb73e5640bb8cf3e233b7233bc5f06ee92
MD5 8846201bdb337e014ef45c571db650f1
SHA1 c8e90d04188060e41d810a9527c9c01f1f4f0cf8
SHA512 5a0af99263510d5a76e630050a206cb9bb2d35290d2722fcf3c9338263107df9ada9acab70f35e5aa7891698ca1634b742c07c6287ee5cf400211d1cc9c0474c
SSDEEP 24576:3AgXeZwhmVm9ZKf1ciQLpNa+62Yii/kpUUhK:3AguK8UKf6L1vi/ky6
TLSH
T14C656B5A62A801E9D0B6D07C8A52C537E6B27C5A03708ADF02E17E673F776E45E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-10-26_8846201bdb337e014ef45c571db650f1_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-10-26_8846201bdb337e014ef45c571db650f1_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.4MB

2026-10-26_8846201bdb337e014ef45c571db650f1_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 0a620cca2c20cb9aa26204fb29f40715
SHA256 07b7a0cae770f1eac6f11f9c5f3af6cb73e5640bb8cf3e233b7233bc5f06ee92
MD5 8846201bdb337e014ef45c571db650f1
SHA1 c8e90d04188060e41d810a9527c9c01f1f4f0cf8
SHA512 5a0af99263510d5a76e630050a206cb9bb2d35290d2722fcf3c9338263107df9ada9acab70f35e5aa7891698ca1634b742c07c6287ee5cf400211d1cc9c0474c
SSDEEP 24576:3AgXeZwhmVm9ZKf1ciQLpNa+62Yii/kpUUhK:3AguK8UKf6L1vi/ky6
TLSH
T14C656B5A62A801E9D0B6D07C8A52C537E6B27C5A03708ADF02E17E673F776E45E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

1f:8e:ab:00:67:4a:dd:be:59:02:31:c7:be:90:c1:13:cd:69:3b:b2:7f:f2:a6:43:06:44:dc:a3:78:de:7a:42

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=201923456H,CN=Bytedance Pte. Ltd.,O=Bytedance Pte. Ltd.,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Chains

Sep 11, 2026

SERIALNUMBER=201923456H,CN=Bytedance Pte. Ltd.,O=Bytedance Pte. Ltd.,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

05:9b:1b:57:9e:8e:21:32:e2:39:07:bd:a7:77:75:5c

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2013 - Jan 15, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=201923456H,CN=Bytedance Pte. Ltd.,O=Bytedance Pte. Ltd.,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Serial Number

0f:76:a4:51:32:93:8a:47:f6:53:2f:ea:5b:22:10:0d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 8, 2025 - Aug 7, 2028

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1558440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

InitOnceComplete InitOnceBeginInitialize AcquireSRWLockShared ReleaseSRWLockShared TryEnterCriticalSection InitializeSRWLock RtlCaptureStackBackTrace SetConsoleTextAttribute GetComputerNameA GetWindowsDirectoryA GetTempPathA GetConsoleScreenBufferInfo CreateProcessW PeekNamedPipe GetCommandLineW FreeLibrary GetProcAddress LoadLibraryExW MultiByteToWideChar WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW GetFileAttributesW GetFileAttributesExW ReadFile RemoveDirectoryW SetFileAttributesW WriteFile CloseHandle GetCurrentProcess OutputDebugStringA OutputDebugStringW GetCurrentProcessId GetLocalTime GetTickCount GetModuleFileNameW FormatMessageA DuplicateHandle TerminateProcess GetExitCodeProcess OpenProcess ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW GetCurrentThreadId GetModuleHandleW LoadLibraryW ReleaseSRWLockExclusive TlsGetValue QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThread SetThreadPriority GetThreadPriority GetSystemTimeAsFileTime QueryThreadCycleTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileInformationByHandle GetFileSizeEx SetEndOfFile SetFilePointerEx GetProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW IsDebuggerPresent CreateThread GetThreadId GetModuleHandleExW GetVersionExW GetNativeSystemInfo CreateThreadpool SetThreadpoolThreadMaximum SetThreadpoolThreadMinimum CloseThreadpool CallbackMayRunLong CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork TlsAlloc TlsSetValue TlsFree AcquireSRWLockExclusive CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetSystemDirectoryW GetWindowsDirectoryW ProcessIdToSessionId QueryFullProcessImageNameW WTSGetActiveConsoleSessionId EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead RtlPcToFileHeader RtlUnwindEx GetFullPathNameW SetStdHandle GetFileType GetConsoleOutputCP GetConsoleMode SetConsoleCtrlHandler ExitProcess GetStdHandle WriteConsoleW HeapAlloc HeapFree GetDriveTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc GetTimeZoneInformation HeapSize IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap LocalFree UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateEventW WaitForSingleObject ResetEvent SetEvent SetLastError MoveFileExW MoveFileW CopyFileW GetTempPathW GetTempFileNameW DeleteFileW SetErrorMode DeleteCriticalSection InitializeCriticalSectionEx RaiseException DecodePointer FlushFileBuffers GetLastError CreatePipe

advapi32

CheckTokenMembership SystemFunction036 ConvertSidToStringSidW GetTokenInformation OpenProcessToken RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey AllocateAndInitializeSid RegisterServiceCtrlHandlerW SetServiceStatus StartServiceCtrlDispatcherW ConvertStringSecurityDescriptorToSecurityDescriptorW FreeSid GetUserNameW ChangeServiceConfigW ChangeServiceConfig2W CloseServiceHandle ControlService CreateServiceW DeleteService OpenSCManagerW OpenServiceW QueryServiceStatus StartServiceW DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf

user32

PeekMessageW MsgWaitForMultipleObjectsEx PostMessageW PostQuitMessage GetQueueStatus SetTimer KillTimer DefWindowProcW RegisterClassExW GetWindowLongPtrW SetWindowLongPtrW DispatchMessageW TranslateMessage MonitorFromWindow CharUpperW UnregisterClassW LoadIconW CreateWindowExW DestroyWindow SetWindowPos SetForegroundWindow AllowSetForegroundWindow GetClientRect GetWindowRect MapWindowPoints GetWindowLongW GetParent GetWindow GetMonitorInfoW

shell32

SHGetFolderPathW ShellExecuteExW SHGetKnownFolderPath CommandLineToArgvW

winmm

timeBeginPeriod timeEndPeriod timeGetTime

ole32

CoInitializeEx CoUninitialize CoTaskMemFree

crypt32

CertNameToStrW

shlwapi

PathMatchSpecW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateSessionsW

dbghelp

SymSetOptions SymCleanup SymGetLineFromAddr64 SymInitialize SymFromAddr UnDecorateSymbolName

Name

.text

Size

720KB

Virtual Size

719KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

235KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

401KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

55KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_8846201bdb337e014ef45c571db650f1_cobalt-strike_icedid_njrat_satacom_vidar

PE Signature issue

kernel32

advapi32

user32

shell32

winmm

ole32

crypt32

shlwapi

wtsapi32

dbghelp

generic