2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar
Size 1.4MB
Sample261102-1z69esfx2l
SHA256 8bb57c76f62eba6f303e01785b23c9897073fd6444f437c212f89d967adb859a
MD5 d0314cdbd45a7a89e0ef7e3fcaddc3f7
SHA1 fa512a6b05f22f65bb8c1b8c76ecdefe63f5b94b
SHA512 9a4af223d98ef1f038e46a614603d1f9bbdedff888ae6b784b59a30dcde60c17d8017183fbbbe0fcdb168b695a6a9e0d6ac90dfbfd87e626dcbdad12654a2c52
SSDEEP 12288:3LqUgvI0uA6bThta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:7qrvIhTLxvXqbwGRz55jAre8MjKiwi
TLSH
T1AA650103B7A9C5B9D07A927815935512F3367906172043CB3362A76EEF7ADE0AE35B02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar

File Explorer

2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar

.exe 1.4MB

2026-11-02_d0314cdbd45a7a89e0ef7e3fcaddc3f7_cobalt-strike_njrat_satacom_vidar

IMPHASH 21c5088120f053f6a67b20e86076cca2
SHA256 8bb57c76f62eba6f303e01785b23c9897073fd6444f437c212f89d967adb859a
MD5 d0314cdbd45a7a89e0ef7e3fcaddc3f7
SHA1 fa512a6b05f22f65bb8c1b8c76ecdefe63f5b94b
SHA512 9a4af223d98ef1f038e46a614603d1f9bbdedff888ae6b784b59a30dcde60c17d8017183fbbbe0fcdb168b695a6a9e0d6ac90dfbfd87e626dcbdad12654a2c52
SSDEEP 12288:3LqUgvI0uA6bThta8SskU8wq/DCdnGw8ZNV6wD83SpxYmcrewTRMFv1Kiw8ll:7qrvIhTLxvXqbwGRz55jAre8MjKiwi
TLSH
T1AA650103B7A9C5B9D07A927815935512F3367906172043CB3362A76EEF7ADE0AE35B02
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

55296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\MouriNaruto\NSudoPrivate\Source\Native\Output\Binaries\Release\x64\NSudoLG.pdb

kernel32

CreateEventW MultiByteToWideChar GetTickCount64 LockResource QueryPerformanceFrequency FindResourceExW LoadResource GetOverlappedResult GetProcAddress VerSetConditionMask FreeLibrary SleepEx VerifyVersionInfoW QueryPerformanceCounter LoadLibraryExW SetPriorityClass GetCurrentProcess OpenProcess WaitForSingleObjectEx GetLocalTime GetCurrentProcessId GetModuleHandleExW ExitProcess Sleep TerminateProcess OutputDebugStringW LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList EncodePointer InitializeSListHead GetSystemTimeAsFileTime IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW InitializeCriticalSection ExpandEnvironmentStringsW GetFileInformationByHandleEx SizeofResource ReadFile MulDiv GetModuleHandleW GetProcessHeap DeleteCriticalSection DecodePointer HeapAlloc RaiseException CloseHandle GetThreadUILanguage GetLastError GetCurrentThreadId GetFileAttributesW CreateFileW InitializeCriticalSectionEx LeaveCriticalSection SetThreadUILanguage HeapFree GetCommandLineW EnterCriticalSection SetLastError ResumeThread RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

user32

SendMessageW GetWindowTextW EndPaint BeginPaint DrawIconEx LoadImageW EndDialog ChangeWindowMessageFilter DestroyIcon UnregisterClassW SetWindowLongPtrW MonitorFromWindow GetDC SetWindowTextW GetDlgItem LoadIconW DialogBoxParamW GetClientRect

gdi32

DeleteDC GetDeviceCaps

comdlg32

GetOpenFileNameW

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW SetThreadToken CreateProcessAsUserW GetAce CloseServiceHandle OpenSCManagerW SetTokenInformation AllocateAndInitializeSid IsWellKnownSid AddAce OpenProcessToken CreateRestrictedToken FreeSid StartServiceW InitializeAcl OpenServiceW GetLengthSid DuplicateTokenEx AddAccessAllowedAce QueryServiceStatusEx GetTokenInformation

shell32

DragQueryFileW DragFinish

ole32

CoInitializeEx

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateProcessesW WTSEnumerateSessionsW

msvcrt

memset memmove __DestructExceptionObject _msize __set_app_type _wcmdln abort _initterm_e _commode _XcptFilter realloc _initterm __setusermatherr __C_specific_handler _CxxThrowException ??0exception@@QEAA@AEBQEBD@Z _wcsnicmp wcsstr malloc wcsrchr free strncmp ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ?what@exception@@UEBAPEBDXZ ??2@YAPEAX_K@Z _wcsicmp __CxxFrameHandler3 ??3@YAXPEAX@Z __wgetmainargs _amsg_exit _errno ?terminate@@YAXXZ _set_fmode ___mb_cur_max_func memcpy __pctype_func tolower wcstol _mbtowc_l wcsnlen localeconv strrchr strcpy_s ceil log10 _clearfp memcmp

Name

.text

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=1, id=261, productName=VS2019 v16.4.4 build 28316, version=28316,

count=2, id=257, productName=VS2019 v16.7.0 build 29110, version=29110,

count=13, id=199, version=41118,

count=3, id=260, version=30034,

count=4, id=259, version=30034,

count=4, id=260, version=27412,

count=7, id=261, version=27412,

count=22, id=261, version=29912,

count=6, id=261, version=30034,

count=7, id=260, productName=VS2019 v16.10.0 build 30037, version=30037,

count=24, id=261, productName=VS2019 v16.10.0 build 30037, version=30037,

count=21, id=257, version=27412,

count=268, id=1, productName=Unmarked objects,

count=5, id=265, version=30037,

count=1, id=255, productName=VS2019 v16.10.0 build 30037, version=30037,

count=4, id=151,

count=1, id=258, productName=VS2019 v16.10.0 build 30037, version=30037,