2026-10-28_7e5d77b4923ae135b155305b430d968f_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_7e5d77b4923ae135b155305b430d968f_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 897KB
Sample261030-bha28avtbw
SHA256 d451661939b2f8540478bc15e79817b7a4877a15477a56cb751e02d0c74f66d3
MD5 7e5d77b4923ae135b155305b430d968f
SHA1 5cade3189e88881de05eb56a83ee9a5a304c3085
SHA512 02d537b3ca1b1e1a6a3e68beae1723a701b1b15f1360a11c42f4919f9485902f02ad12aab472ebba4e7e6e31b88a8c321c28d41e2fe4e9420fba759ab5c4450e
SSDEEP 12288:6LO9ffhKxs53AuGDuhAwj86wXIfXwf6ttMQZoAy3c4ZdYi5x0zv79P:6efhKxs5QxDIM6wy+6ttTZ3y3cm
TLSH
T10815AE97A39807E9E0B7D134C9868A07FA75B84603609BDF13E082661F637D19E7F361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_7e5d77b4923ae135b155305b430d968f_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-10-28_7e5d77b4923ae135b155305b430d968f_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 897KB

2026-10-28_7e5d77b4923ae135b155305b430d968f_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH a70ab050df76a991a6e74862f68eb692
SHA256 d451661939b2f8540478bc15e79817b7a4877a15477a56cb751e02d0c74f66d3
MD5 7e5d77b4923ae135b155305b430d968f
SHA1 5cade3189e88881de05eb56a83ee9a5a304c3085
SHA512 02d537b3ca1b1e1a6a3e68beae1723a701b1b15f1360a11c42f4919f9485902f02ad12aab472ebba4e7e6e31b88a8c321c28d41e2fe4e9420fba759ab5c4450e
SSDEEP 12288:6LO9ffhKxs53AuGDuhAwj86wXIfXwf6ttMQZoAy3c4ZdYi5x0zv79P:6efhKxs5QxDIM6wy+6ttTZ3y3cm
TLSH
T10815AE97A39807E9E0B7D134C9868A07FA75B84603609BDF13E082661F637D19E7F361
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

921600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ord165 CommandLineToArgvW

kernel32

DeleteCriticalSection GetACP SetEndOfFile GetTempPathW GetCommandLineW LocalFree GetLastError CreateFileW DeleteFileW RemoveDirectoryW WriteFile CloseHandle WideCharToMultiByte GetModuleFileNameW FileTimeToSystemTime AllocConsole LoadResource LockResource SizeofResource FindResourceW IsValidCodePage WriteConsoleW HeapSize SetFilePointerEx GetFileSizeEx ReadFile GetConsoleOutputCP FlushFileBuffers HeapReAlloc ReadConsoleW ReadConsoleInputW SetConsoleMode GetConsoleMode GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW SetStdHandle FlsFree GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA DeviceIoControl FormatMessageA GetLocaleInfoEx FindClose FindFirstFileExW FindNextFileW AreFileApisANSI GetModuleHandleW GetProcAddress MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx FlsSetValue EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind GetConsoleCP ExitProcess GetModuleHandleExW GetStdHandle HeapAlloc HeapFree FlsAlloc FlsGetValue GetOEMCP

version

VerQueryValueW

setupapi

SetupDiSetDeviceInstallParamsW CM_Reenumerate_DevNode SetupDiCallClassInstaller SetupDiGetINFClassW SetupDiCreateDeviceInfoW SetupUninstallOEMInfW SetupDiSetDeviceRegistryPropertyW CM_Get_Parent SetupDiGetDevicePropertyW SetupDiGetClassDevsW SetupDiDestroyDriverInfoList SetupDiGetDriverInfoDetailW SetupDiEnumDriverInfoW SetupDiBuildDriverInfoList SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiCreateDeviceInfoList SetupGetInfDriverStoreLocationW SetupDiGetDeviceRegistryPropertyW SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailW

rpcrt4

UuidCreate RpcStringFreeW UuidToStringW

newdev

DiInstallDriverW DiUninstallDevice

Name

.text

Size

371KB

Virtual Size

371KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

116KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

357KB

Virtual Size

357KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.zero

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_7e5d77b4923ae135b155305b430d968f_cobalt-strike_icedid_njrat_satacom_stealc_vidar

shell32

kernel32

version

setupapi

rpcrt4

newdev

generic