2026-10-28_e38a39b0867e24eedebe63828cf3f251_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-10-28_e38a39b0867e24eedebe63828cf3f251_cobalt-strike_icedid_njrat_satacom_vidar
Size 3.3MB
Sample261029-ef6ynag17v
SHA256 fe4de0fd380724f99aafe701b01c58477b5a883212388c9b77f1fa77e00b66a6
MD5 e38a39b0867e24eedebe63828cf3f251
SHA1 f6337c63439dd024afc39f37b6a31c94ee3b4cb8
SHA512 fdb546f9f379e6304e80f0e64547a276707ead0c59d3b47b5644bed1220f2237981f009b6ca69d182de9df2b8e34b46e6b33f8b1aa7f04fd3d158554d3945f53
SSDEEP 6144:PCdxxOZG8C9VCbPNunBlfBh0KJtwKO3fzEHcn7W:PCdxxOZG8eC1sX0OnKV
TLSH
T194F59D06B7941AFDD077D13CCA964F0AEAB2B8154761E74F03AD46AA1F237605D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_e38a39b0867e24eedebe63828cf3f251_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-10-28_e38a39b0867e24eedebe63828cf3f251_cobalt-strike_icedid_njrat_satacom_vidar

.exe 3.3MB

2026-10-28_e38a39b0867e24eedebe63828cf3f251_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH a114309e02579cec0103160c871734e0
SHA256 fe4de0fd380724f99aafe701b01c58477b5a883212388c9b77f1fa77e00b66a6
MD5 e38a39b0867e24eedebe63828cf3f251
SHA1 f6337c63439dd024afc39f37b6a31c94ee3b4cb8
SHA512 fdb546f9f379e6304e80f0e64547a276707ead0c59d3b47b5644bed1220f2237981f009b6ca69d182de9df2b8e34b46e6b33f8b1aa7f04fd3d158554d3945f53
SSDEEP 6144:PCdxxOZG8C9VCbPNunBlfBh0KJtwKO3fzEHcn7W:PCdxxOZG8eC1sX0OnKV
TLSH
T194F59D06B7941AFDD077D13CCA964F0AEAB2B8154761E74F03AD46AA1F237605D3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

17372

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateDirectoryA HeapAlloc GetProcessHeap Sleep GetLocalTime lstrlenA CloseHandle HeapFree GetCurrentProcessId OpenProcess GetModuleFileNameW LoadLibraryA MultiByteToWideChar WriteConsoleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetCurrentThread OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW SetConsoleCtrlHandler HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadFile ReadConsoleW CreateFileW RtlUnwind

Name

.text

Size

321KB

Virtual Size

320KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

70KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.9MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_e38a39b0867e24eedebe63828cf3f251_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

generic