2026-11-02_e517c95bba7a53a2db1cb7a9f7862c6c_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-11-02_e517c95bba7a53a2db1cb7a9f7862c6c_cobalt-strike_icedid_njrat_satacom_vidar
Size 2.0MB
Sample261102-yn4caae16p
SHA256 3e910db143d641f957b809b064cc1fedfc2f2ba17d650cfd8f1b91bfedb41c2b
MD5 e517c95bba7a53a2db1cb7a9f7862c6c
SHA1 0b2c0961c5214bc6b2c115d0ff3bbbccd0348f1f
SHA512 06edd3938dd157ec60f1412dcfcf7bd2ded72fb003cb435d2d8997f0d4339048e105d92b0a6c3063b9a6e347861f15bb7261f6f44bb02d72d357299f6384efb2
SSDEEP 24576:rZ6aAGvASwRYJiejsqjnhMgeiCl7G0nehbGZpbD:6Gva6tnDmg27RnWGj
TLSH
T15EA5E04A77544BF9D177C13CC6929A46F9B278492721A79F03E84ABA1F237A00D3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_e517c95bba7a53a2db1cb7a9f7862c6c_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-11-02_e517c95bba7a53a2db1cb7a9f7862c6c_cobalt-strike_icedid_njrat_satacom_vidar

.exe 2.0MB

2026-11-02_e517c95bba7a53a2db1cb7a9f7862c6c_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH d76d56bd82300fa3a43ab55b202ec152
SHA256 3e910db143d641f957b809b064cc1fedfc2f2ba17d650cfd8f1b91bfedb41c2b
MD5 e517c95bba7a53a2db1cb7a9f7862c6c
SHA1 0b2c0961c5214bc6b2c115d0ff3bbbccd0348f1f
SHA512 06edd3938dd157ec60f1412dcfcf7bd2ded72fb003cb435d2d8997f0d4339048e105d92b0a6c3063b9a6e347861f15bb7261f6f44bb02d72d357299f6384efb2
SSDEEP 24576:rZ6aAGvASwRYJiejsqjnhMgeiCl7G0nehbGZpbD:6Gva6tnDmg27RnWGj
TLSH
T15EA5E04A77544BF9D177C13CC6929A46F9B278492721A79F03E84ABA1F237A00D3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

36080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\jenkins\workspace\dptf\Src\IPF\Windows\Solution\Build\x64\Release\ipfsvc.pdb

kernel32

GetModuleFileNameW OutputDebugStringA GetSystemDirectoryW FormatMessageA LocalFree ResetEvent ReleaseMutex CreateMutexW CreateEventW LoadLibraryExA GetProcAddress GetModuleHandleExA FreeLibrary CreateThread CreateSemaphoreW Sleep WaitForSingleObject ReleaseSemaphore AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetLastError CloseHandle GetFileAttributesA QueryPerformanceFrequency WriteConsoleW GetModuleFileNameA HeapAlloc HeapFree GetProcessHeap GetSystemDirectoryA SetEvent ReadConsoleW ReadFile HeapReAlloc HeapSize GetTimeZoneInformation SetFilePointerEx QueryPerformanceCounter GetFileSizeEx GetConsoleMode __C_specific_handler RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedPushEntrySList InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlUnwindEx EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetStdHandle WriteFile GetCommandLineA GetCommandLineW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetCurrentThread MultiByteToWideChar DeleteFileW RemoveDirectoryW GetStringTypeW WideCharToMultiByte SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW SetStdHandle OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetConsoleCtrlHandler FlushFileBuffers GetConsoleOutputCP RtlUnwind

advapi32

RegGetValueA StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey EventRegister EventWriteString EventProviderEnabled EventWrite EventUnregister

api-ms-win-service-core-l1-1-3

GetServiceRegistryStateKey

setupapi

CM_Get_Device_ID_ListA CM_Open_DevNode_Key CM_Locate_DevNodeA CM_Get_Device_Interface_List_SizeA CM_Get_Device_ID_List_SizeA

Name

.text

Size

377KB

Virtual Size

377KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.5MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_e517c95bba7a53a2db1cb7a9f7862c6c_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

advapi32

api-ms-win-service-core-l1-1-3

setupapi

generic