2026-11-12_5af4423c7f987eb5bcd8d57fea06b4fe_cobalt-strike_icedid_satacom_vidar

General

Target
2026-11-12_5af4423c7f987eb5bcd8d57fea06b4fe_cobalt-strike_icedid_satacom_vidar
Size 227KB
Sample261113-cs7dvaft2p
SHA256 c191000d6a76557d85c72f3bdcc1b6472cd988d1c62f56853ab54c3d84607cca
MD5 5af4423c7f987eb5bcd8d57fea06b4fe
SHA1 b29490e491fdb6045944fbfa155e2580bb379bdf
SHA512 0f5db76127d06d550383ff378f9ff373efb49ae92464deb7e3373b798d18551862690222c7a5aa066c867112558af034a30730fa8929f1617d23216a8304f6d4
SSDEEP 3072:QenCCJlnP24ywmA7p8IRbPM2V4EoGB8TzWqO+IMZvBPJswSMM0dDzzNGucMGDqAw:jCCJde4ywrP/iEcHjO+IMx5YxMLn
TLSH
T161346B1B73A508FBE876823DC4535A06D772B8024761CBAF076442AA5F237D1AD3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-12_5af4423c7f987eb5bcd8d57fea06b4fe_cobalt-strike_icedid_satacom_vidar

File Explorer

2026-11-12_5af4423c7f987eb5bcd8d57fea06b4fe_cobalt-strike_icedid_satacom_vidar

.exe 227KB

2026-11-12_5af4423c7f987eb5bcd8d57fea06b4fe_cobalt-strike_icedid_satacom_vidar

IMPHASH 56bfda7073ea0a159d22e925194a7054
SHA256 c191000d6a76557d85c72f3bdcc1b6472cd988d1c62f56853ab54c3d84607cca
MD5 5af4423c7f987eb5bcd8d57fea06b4fe
SHA1 b29490e491fdb6045944fbfa155e2580bb379bdf
SHA512 0f5db76127d06d550383ff378f9ff373efb49ae92464deb7e3373b798d18551862690222c7a5aa066c867112558af034a30730fa8929f1617d23216a8304f6d4
SSDEEP 3072:QenCCJlnP24ywmA7p8IRbPM2V4EoGB8TzWqO+IMZvBPJswSMM0dDzzNGucMGDqAw:jCCJde4ywrP/iEcHjO+IMx5YxMLn
TLSH
T161346B1B73A508FBE876823DC4535A06D772B8024761CBAF076442AA5F237D1AD3EF61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW RegCloseKey RegCreateKeyExW RegSetValueExW OpenProcessToken

kernel32

SetFileAttributesW CloseHandle GetLastError WaitForSingleObject CreateMutexW GetCurrentProcess CreateProcessW OpenProcess GetModuleFileNameW CopyFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW CreateRemoteThread VirtualAllocEx WriteProcessMemory WriteConsoleW CreateFileW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW TerminateProcess GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

shell32

SHGetFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-12_5af4423c7f987eb5bcd8d57fea06b4fe_cobalt-strike_icedid_satacom_vidar

advapi32

kernel32

shell32

generic