2026-11-09_4966b28c003bed00d990904090e3c7bf_akira_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-11-09_4966b28c003bed00d990904090e3c7bf_akira_cobalt-strike_icedid_njrat_satacom_vidar
Size 4.1MB
Sample261110-zekdgsba38
SHA256 fe91f8ee6d70409a26e906addbac418fdb42c0ca81868cadacc46bad3e37f69a
MD5 4966b28c003bed00d990904090e3c7bf
SHA1 1010c8a1b3fa6a99fabc060210ddd7ade1f7b339
SHA512 b688487e70b1ed908adc0815cb54cc703caa122be25e4ede28a3495fff46b6f5f8f196452fbad8a623b610050b8e6042608ba09b9526e8606f8b3b9a9ce67b09
SSDEEP 49152:807ABNrf2SU0KSIp2yv8oOEfed2RMCQC8nXc5EikzXztCfU0yutc7idbbHOMMKlJ:808yNFfO/nXc5Xk3t+nb75MKpmkfJ4k
TLSH
T18C169D17616D00EAC467D0788A5B8A03EB727C93036097DB52E046365FA7BE17E7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_4966b28c003bed00d990904090e3c7bf_akira_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-11-09_4966b28c003bed00d990904090e3c7bf_akira_cobalt-strike_icedid_njrat_satacom_vidar

.exe 4.1MB

2026-11-09_4966b28c003bed00d990904090e3c7bf_akira_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH 81a885c6d84d55f588d3a3902d16ac5b
SHA256 fe91f8ee6d70409a26e906addbac418fdb42c0ca81868cadacc46bad3e37f69a
MD5 4966b28c003bed00d990904090e3c7bf
SHA1 1010c8a1b3fa6a99fabc060210ddd7ade1f7b339
SHA512 b688487e70b1ed908adc0815cb54cc703caa122be25e4ede28a3495fff46b6f5f8f196452fbad8a623b610050b8e6042608ba09b9526e8606f8b3b9a9ce67b09
SSDEEP 49152:807ABNrf2SU0KSIp2yv8oOEfed2RMCQC8nXc5EikzXztCfU0yutc7idbbHOMMKlJ:808yNFfO/nXc5Xk3t+nb75MKpmkfJ4k
TLSH
T18C169D17616D00EAC467D0788A5B8A03EB727C93036097DB52E046365FA7BE17E7FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2495620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetStdHandle GetTimeZoneInformation CreatePipe GetExitCodeProcess SetFilePointerEx GetFileSizeEx WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapFree HeapAlloc SetEnvironmentVariableW GetCommandLineW GetCommandLineA SetEndOfFile HeapSize ReadConsoleW WriteFile GetStdHandle GetModuleFileNameW PeekNamedPipe GetFileType GetFileInformationByHandle CreateFileW GetFullPathNameW GetDriveTypeW CloseHandle GetLastError InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS WaitForSingleObject Sleep GetCurrentThread TlsAlloc TlsGetValue TlsSetValue TlsFree QueryPerformanceCounter QueryPerformanceFrequency CreateThread GetProcAddress LoadLibraryA RaiseException GetCurrentProcess TerminateProcess GetSystemTimeAsFileTime CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesExW RemoveDirectoryW MoveFileW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime FreeLibrary ReleaseMutex CreateMutexA WideCharToMultiByte MultiByteToWideChar WaitForSingleObjectEx GetCurrentThreadId InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetModuleHandleW GetStringTypeW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead GetCurrentDirectoryW RtlPcToFileHeader RtlUnwindEx SetLastError LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess DuplicateHandle CreateProcessW ReadFile SetCurrentDirectoryW RtlUnwind

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

718KB

Virtual Size

717KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

86KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

592KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-09_4966b28c003bed00d990904090e3c7bf_akira_cobalt-strike_icedid_njrat_satacom_vidar

kernel32

generic