2026-11-02_c7cb9b3b09d8fb55cb1d1e06fea5f4cc_cobalt-strike_icedid_njrat_satacom_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_c7cb9b3b09d8fb55cb1d1e06fea5f4cc_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 1.6MB
Sample261102-2xlelsxvds
SHA256 3d8f5733200c552a20b7a03f3954d211e03726a0613b52f8f5cd56629331b3b2
MD5 c7cb9b3b09d8fb55cb1d1e06fea5f4cc
SHA1 178134928c7ce395476321ba0ca4997ce1937ad3
SHA512 b5c70755e502a860b7a6b26edfdf6d2dac7fd64fbdf8c3eeb2771162c990363cca5f2615c19ed392bf3a92db141a6242fdb6f2b5a2ae1bf9c1f7cc9410562a53
SSDEEP 49152:4Xf6hs9L7hV3LA5PgPZ4atdZLNiXicJFFRGNzj3:e7nLA5Q7wRGpj3
TLSH
T177859D45AE9BC5E9D07BA13FCA564D02D5BEF606031396CB0B904A753F136E34D3A3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_c7cb9b3b09d8fb55cb1d1e06fea5f4cc_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-11-02_c7cb9b3b09d8fb55cb1d1e06fea5f4cc_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 1.6MB

2026-11-02_c7cb9b3b09d8fb55cb1d1e06fea5f4cc_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH d58a7367651c987333c653a633c4e885
SHA256 3d8f5733200c552a20b7a03f3954d211e03726a0613b52f8f5cd56629331b3b2
MD5 c7cb9b3b09d8fb55cb1d1e06fea5f4cc
SHA1 178134928c7ce395476321ba0ca4997ce1937ad3
SHA512 b5c70755e502a860b7a6b26edfdf6d2dac7fd64fbdf8c3eeb2771162c990363cca5f2615c19ed392bf3a92db141a6242fdb6f2b5a2ae1bf9c1f7cc9410562a53
SSDEEP 49152:4Xf6hs9L7hV3LA5PgPZ4atdZLNiXicJFFRGNzj3:e7nLA5Q7wRGpj3
TLSH
T177859D45AE9BC5E9D07BA13FCA564D02D5BEF606031396CB0B904A753F136E34D3A3A2
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

348768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\gcomp\rel\src\NvContainer\_out\x86_64\release\container\NvContainer.pdb

shlwapi

PathIsRelativeW

kernel32

ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW OutputDebugStringA Sleep GetCurrentThreadId ProcessIdToSessionId GetSystemTime GetSystemTimeAsFileTime CreateTimerQueueTimer DeleteTimerQueueTimer GetModuleFileNameW GetModuleHandleExW MoveFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateDirectoryW FreeLibrary GetProcAddress FindCloseChangeNotification FindFirstChangeNotificationW FindNextChangeNotification GetCurrentDirectoryW SetLastError GetErrorMode SetErrorMode LoadLibraryExW VerSetConditionMask CreateFileW GetFullPathNameW LocalFree CreateProcessA CreateProcessW GetSystemDirectoryW GetModuleFileNameA lstrcmpA VerifyVersionInfoW FileTimeToSystemTime RemoveDirectoryW DeviceIoControl MultiByteToWideChar WideCharToMultiByte VirtualQuery VirtualProtect GetSystemInfo WriteConsoleW HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetStringTypeW HeapReAlloc ReadConsoleW ReadFile SetStdHandle GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers LocalAlloc GetCurrentProcessId GetLastError RemoveVectoredContinueHandler AddVectoredContinueHandler RemoveVectoredExceptionHandler AddVectoredExceptionHandler SetUnhandledExceptionFilter RtlCaptureStackBackTrace RtlUnwind GetModuleHandleW OpenProcess CreateThread WaitForMultipleObjects OpenEventW CreateEventW WaitForSingleObject SetEvent CloseHandle GetCurrentProcess GetProcessTimes SetDefaultDllDirectories LoadLibraryExA OutputDebugStringW FormatMessageA SetCurrentDirectoryW FindFirstFileExW GetDiskFreeSpaceExW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW SetEndOfFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime GetTempPathW AreFileApisANSI CreateDirectoryExW CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedPushEntrySList InterlockedFlushSList RtlPcToFileHeader RaiseException RtlUnwindEx EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetFileType GetCPInfo GetStdHandle WriteFile GetCurrentThread HeapAlloc HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleCtrlHandler

user32

LoadStringW PostThreadMessageW PeekMessageW GetMessageW ShutdownBlockReasonDestroy ShutdownBlockReasonCreate SetWindowLongPtrW GetWindowLongPtrW DestroyWindow CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW PostMessageW DispatchMessageW TranslateMessage

shell32

SHGetKnownFolderPath CommandLineToArgvW

ole32

CoTaskMemFree

advapi32

OpenServiceW RegSetKeyValueW RegOpenKeyExW RegGetValueW RegDeleteValueW GetUserNameW BuildExplicitAccessWithNameW SetSecurityInfo GetSecurityInfo SetEntriesInAclW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenSCManagerW CloseServiceHandle ChangeServiceConfigW RegSetValueExW RegCreateKeyExW RegCloseKey LookupAccountSidW CreateWellKnownSid OpenProcessToken

Name

.text

Size

758KB

Virtual Size

757KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_c7cb9b3b09d8fb55cb1d1e06fea5f4cc_cobalt-strike_icedid_njrat_satacom_stealc_vidar

shlwapi

kernel32

user32

shell32

ole32

advapi32

generic