2026-11-07_a4a82bcba873951fd85d5af6728d15e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar

General

Target
2026-11-07_a4a82bcba873951fd85d5af6728d15e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar
Size 327KB
Sample261107-nj2msabs8w
SHA256 fcb821c1405dc4deeeb8c9d9aa56259f6f9c4b1cad73c5dcece72ef6848cb5cc
MD5 a4a82bcba873951fd85d5af6728d15e6
SHA1 582153240c113cbeeecd22202e2fbc2f6a69779b
SHA512 e8414e349c22f92ddeb2e5e194289ffc8ecc0d90a56a20e2ad1829ed572373f5ec56d605963bc236ccaf63e819fc2898caeced9968522fb256e17b0691349bab
SSDEEP 6144:K8e/bd77L35RAM1qHbSd6TMnnmoAB7ozj2563MohsFSNGRA0:fe/bdPL3DeHbSdTnA7oi63Mo2FJ
TLSH
T1EB646C1AF3A510F9F977C17CC9929906E6727C1A03308AEF27A04A562F277D09D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-07_a4a82bcba873951fd85d5af6728d15e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar

File Explorer

2026-11-07_a4a82bcba873951fd85d5af6728d15e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar

.exe 327KB

2026-11-07_a4a82bcba873951fd85d5af6728d15e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar

IMPHASH 5966777c48416258d0c8243e8003c6b6
SHA256 fcb821c1405dc4deeeb8c9d9aa56259f6f9c4b1cad73c5dcece72ef6848cb5cc
MD5 a4a82bcba873951fd85d5af6728d15e6
SHA1 582153240c113cbeeecd22202e2fbc2f6a69779b
SHA512 e8414e349c22f92ddeb2e5e194289ffc8ecc0d90a56a20e2ad1829ed572373f5ec56d605963bc236ccaf63e819fc2898caeced9968522fb256e17b0691349bab
SSDEEP 6144:K8e/bd77L35RAM1qHbSd6TMnnmoAB7ozj2563MohsFSNGRA0:fe/bdPL3DeHbSdTnA7oi63Mo2FJ
TLSH
T1EB646C1AF3A510F9F977C17CC9929906E6727C1A03308AEF27A04A562F277D09D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

95596

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

IntersectRect IsRectEmpty OffsetRect GetWindowThreadProcessId GetParent GetWindowLongPtrW GetClientRect GetPropW GetDpiForSystem SetThreadDpiAwarenessContext GetGuiResources EqualRect FillRect

gdi32

GetWindowOrgEx CreatePalette TextOutW GetGlyphIndicesW GetCharABCWidthsW StretchBlt PatBlt GdiFlush GetTextFaceW SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx BitBlt CreateBitmap CreateCompatibleDC CreateFontIndirectW CreateFontW CreateSolidBrush DeleteDC DeleteObject GetBkColor GetBkMode GetCurrentObject GetGraphicsMode GetMapMode GetPaletteEntries GetTextAlign GetTextColor GetTextExtentPointA GetTextExtentPoint32W GetViewportExtEx GetViewportOrgEx GetWindowExtEx ExtTextOutW RestoreDC RealizePalette SaveDC SelectObject SelectPalette SetBkColor SetBkMode SetDIBits SetGraphicsMode SetMapMode SetStretchBltMode SetTextColor SetTextAlign GetWorldTransform SetWorldTransform CreateDIBSection GetObjectW ExtTextOutA LPtoDP

kernel32

GetFileSizeEx HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW CreateFileW GetFileAttributesW WriteFile CloseHandle GetLastError GetCurrentProcess MulDiv lstrcmpA MultiByteToWideChar IsDBCSLeadByteEx SetLastError GetCurrentProcessId GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW lstrcmpiW WideCharToMultiByte FreeLibrary LoadLibraryExW GetConsoleMode QueryPerformanceCounter QueryPerformanceFrequency LocalFree FormatMessageA FindClose FindFirstFileExW FindNextFileW SetFilePointerEx AreFileApisANSI EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime GetProcAddress EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP

Name

.text

Size

217KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-07_a4a82bcba873951fd85d5af6728d15e6_cobalt-strike_icedid_njrat_satacom_stealc_vidar

user32

gdi32

kernel32

generic