shodi | 2026-11-03_aae4e026d9b625b1e51106007d5fae2f_cobalt-strike_icedid_njrat_rhadamanthys_satacom_vidar

General

Target
2026-11-03_aae4e026d9b625b1e51106007d5fae2f_cobalt-strike_icedid_njrat_rhadamanthys_satacom_vidar
Size 641KB
Sample261104-nbc98aby9n
SHA256 245ad5ba86760fa2b0e3c0e5b8ae0f796570b515fbef7536082617d643a98caa
MD5 aae4e026d9b625b1e51106007d5fae2f
SHA1 5a93abd1e894678cac1e136821df5ed922a835e9
SHA512 6ccaf5f9dd6dd11c1478c9870fec994ef4951b5a15db30560913dbf61af28382c426db044d15f7b98e76d27a93d6ce5a0a85da72f3d647a003058125b6389b9a
SSDEEP 6144:GSTYQelhsIAHszI8TBqsk59kaw3XPDquMVlQSPIR:/TYQe7sIAHszNS597ibqu0ljc
TLSH
T17CD47C4677A045FAD177D27DC9624B16EAB278155730E34F03AC87BA1F233A05E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

worm shodi

Malware Config

Signatures

Family: Shodi
Shodi is a Windows worm written in C++.
worm shodi

Detects Shodi worm 1 IoCs

resource	yara_rule
sample	family_shodi

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-03_aae4e026d9b625b1e51106007d5fae2f_cobalt-strike_icedid_njrat_rhadamanthys_satacom_vidar

File Explorer

2026-11-03_aae4e026d9b625b1e51106007d5fae2f_cobalt-strike_icedid_njrat_rhadamanthys_satacom_vidar

.exe 641KB

2026-11-03_aae4e026d9b625b1e51106007d5fae2f_cobalt-strike_icedid_njrat_rhadamanthys_satacom_vidar

IMPHASH 813cf7b73f18cc814cc7ecafb2bbf796
SHA256 245ad5ba86760fa2b0e3c0e5b8ae0f796570b515fbef7536082617d643a98caa
MD5 aae4e026d9b625b1e51106007d5fae2f
SHA1 5a93abd1e894678cac1e136821df5ed922a835e9
SHA512 6ccaf5f9dd6dd11c1478c9870fec994ef4951b5a15db30560913dbf61af28382c426db044d15f7b98e76d27a93d6ce5a0a85da72f3d647a003058125b6389b9a
SSDEEP 6144:GSTYQelhsIAHszI8TBqsk59kaw3XPDquMVlQSPIR:/TYQe7sIAHszNS597ibqu0ljc
TLSH
T17CD47C4677A045FAD177D27DC9624B16EAB278155730E34F03AC87BA1F233A05E3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Shodi worm
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14532

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\A\34\b\bin\amd64\venvwlauncher.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

advapi32

RegCloseKey RegEnumKeyW RegOpenKeyExW RegQueryValueExW

kernel32

WriteConsoleW SetEndOfFile LeaveCriticalSection HeapReAlloc GetStartupInfoW SetConsoleCtrlHandler SetInformationJobObject QueryInformationJobObject GetBinaryTypeW GetCommandLineW GetCurrentProcess GetStdHandle AssignProcessToJobObject GetModuleFileNameW SetEnvironmentVariableW GetEnvironmentVariableW GetFileAttributesW DuplicateHandle MultiByteToWideChar GetPrivateProfileStringW FormatMessageW GetLastError WaitForSingleObjectEx CloseHandle CreateJobObjectA CreateProcessW GetExitCodeProcess HeapSize CreateFileW SetFilePointerEx GetFileSizeEx GetProcessHeap RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError EnterCriticalSection RtlUnwind DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetCommandLineA WriteFile HeapFree HeapAlloc GetCurrentThread GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode GetStringTypeW ReadFile ReadConsoleW OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle

user32

MessageBoxW PostMessageA GetMessageA

Name

.text

Size

334KB

Virtual Size

333KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-03_aae4e026d9b625b1e51106007d5fae2f_cobalt-strike_icedid_njrat_rhadamanthys_satacom_vidar

version

advapi32

kernel32

user32

generic