2026-11-07_cd10e8bc3b3ef322446883ed744b7e50_cobalt-strike_icedid_njrat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-07_cd10e8bc3b3ef322446883ed744b7e50_cobalt-strike_icedid_njrat_satacom_vidar
Size 3.5MB
Sample261107-l5bblsee87
SHA256 a738effe62f90f4b4083be556b7bd13a557c4180c763fe8e57b0d84f7160fd64
MD5 cd10e8bc3b3ef322446883ed744b7e50
SHA1 20929ac0c9cfa335270ac94d92f6b0310e4c99da
SHA512 4d95b1c1ef90130a2336ed0e16820d874db363944235e926c558294d7d2e6607852cfa1082b5ea14675e1c36832e112db1aa6721410e64397d309426ac950c56
SSDEEP 98304:QyUCDASKL5tedu8p64LCSgorLbemhYC/zbgVFySyC2LHTrXLvvVPNl:QEDASKL5teduk6ZonHvgvySyC2LHTrXl
TLSH
T11606F1D4CE52C8E7C06402B11AD6893CF9B3E8AF4B41B5BB20E9D53325435AF5CBBA45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_cd10e8bc3b3ef322446883ed744b7e50_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-11-07_cd10e8bc3b3ef322446883ed744b7e50_cobalt-strike_icedid_njrat_satacom_vidar

.exe 3.5MB

2026-11-07_cd10e8bc3b3ef322446883ed744b7e50_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH a011d5c0647005ddb2ed3526d77a6a49
SHA256 a738effe62f90f4b4083be556b7bd13a557c4180c763fe8e57b0d84f7160fd64
MD5 cd10e8bc3b3ef322446883ed744b7e50
SHA1 20929ac0c9cfa335270ac94d92f6b0310e4c99da
SHA512 4d95b1c1ef90130a2336ed0e16820d874db363944235e926c558294d7d2e6607852cfa1082b5ea14675e1c36832e112db1aa6721410e64397d309426ac950c56
SSDEEP 98304:QyUCDASKL5tedu8p64LCSgorLbemhYC/zbgVFySyC2LHTrXLvvVPNl:QEDASKL5teduk6ZonHvgvySyC2LHTrXl
TLSH
T11606F1D4CE52C8E7C06402B11AD6893CF9B3E8AF4B41B5BB20E9D53325435AF5CBBA45
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

97072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadLibraryW GetProcAddress FreeLibrary CreateDirectoryW SetLastError GetCommandLineW FindNextFileW GetCurrentProcess GetStdHandle FindClose MultiByteToWideChar GetLastError GlobalFlags GetSystemInfo GetCurrentDirectoryW SetCurrentDirectoryW CreateProcessW GetModuleHandleW WideCharToMultiByte VirtualQuery HeapFree HeapReAlloc HeapAlloc GetProcessHeap SetEvent CreateThread ResetEvent GetLocalTime GetSystemTimeAsFileTime lstrcpynW WriteConsoleW HeapSize FlushFileBuffers GetTickCount SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetFileType GetCommandLineA GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx DeleteCriticalSection FindResourceW LoadResource LockResource FreeResource GetCurrentThreadId InitializeCriticalSection ExitProcess SizeofResource MulDiv GlobalUnlock GlobalLock GlobalFree GlobalAlloc LeaveCriticalSection EnterCriticalSection TryEnterCriticalSection GetProcessHandleCount TerminateProcess OpenProcess GetCurrentProcessId WriteFile Sleep CreateFileW IsDebuggerPresent CreateEventW CloseHandle GetModuleFileNameW InitializeCriticalSectionAndSpinCount GetStringTypeW

user32

DispatchMessageW TranslateMessage ReleaseDC MessageBoxW GetMessageW GetDC LoadImageW GetParent GetDesktopWindow LoadCursorW LoadIconW LoadStringW GetWindowLongPtrW SendMessageW GetWindowThreadProcessId MonitorFromWindow WaitForInputIdle EnumWindows

gdi32

SelectObject CreateDIBSection SetDIBColorTable CreateCompatibleDC GetDeviceCaps DeleteDC GetObjectW DeleteObject

shell32

SHGetSpecialFolderPathW

ole32

CoUninitialize CoInitializeEx CreateStreamOnHGlobal

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime

comctl32

ImageList_Destroy ImageList_Create ImageList_AddMasked

gdiplus

GdipCreateBitmapFromScan0 GdiplusStartup GdiplusShutdown GdipGetImageHeight GdipGetImagePaletteSize GdipCloneImage GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipAlloc GdipDrawImageRectI GdipDisposeImage GdipGetImagePixelFormat GdipFree GdipBitmapLockBits GdipGetImageGraphicsContext GdipDeleteGraphics GdipGetImagePalette GdipSetCompositingMode GdipGetImageWidth GdipCreateBitmapFromFile

ws2_32

WSACleanup

Name

.text

Size

179KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_cd10e8bc3b3ef322446883ed744b7e50_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

user32

gdi32

shell32

ole32

oleaut32

comctl32

gdiplus

ws2_32

generic