2026-01-16_6de2f633f433c350a42d705ffcb839e1_cobalt-strike_icedid_njrat_ryuk_satacom_vidar[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2026-01-16_6de2f633f433c350a42d705ffcb839e1_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe
Size 2.7MB
Sample261113-nfqq4sty4p
SHA256 fd59198089215fff211c6e10387ee3d85d25f593e74d23b2f3e712c51cf276f9
MD5 f65ab312f2f7a4ae8785b82581b73428
SHA1 2686c83a11d8e41068518c6037263e53cf9dfd2c
SHA512 82a24370092497c4a0b612e1b220d9bcfdec2a2f743e2daa0add2020e546f75a930f5ada9051c42ab46fe296aafb164874bf2d324ed78be9a18215e1c3442030
SSDEEP 49152:Wdd6KwFDC54YK9KJm/6hdBkXwKqEn7SDeufrQnwh3:fy3BkXwtJfEnwN
TLSH
T18ED59D33F699C0D8D099C274D78A8172E9757C460B20A6EF0B90B7291E77FE01B7A794
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-01-16_6de2f633f433c350a42d705ffcb839e1_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

File Explorer

2026-01-16_6de2f633f433c350a42d705ffcb839e1_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

.exe 2.7MB

2026-01-16_6de2f633f433c350a42d705ffcb839e1_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

IMPHASH 9d3b05f2cf11e8a13ca61bb7756a0697
SHA256 fd59198089215fff211c6e10387ee3d85d25f593e74d23b2f3e712c51cf276f9
MD5 f65ab312f2f7a4ae8785b82581b73428
SHA1 2686c83a11d8e41068518c6037263e53cf9dfd2c
SHA512 82a24370092497c4a0b612e1b220d9bcfdec2a2f743e2daa0add2020e546f75a930f5ada9051c42ab46fe296aafb164874bf2d324ed78be9a18215e1c3442030
SSDEEP 49152:Wdd6KwFDC54YK9KJm/6hdBkXwKqEn7SDeufrQnwh3:fy3BkXwtJfEnwN
TLSH
T18ED59D33F699C0D8D099C274D78A8172E9757C460B20A6EF0B90B7291E77FE01B7A794
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1117568

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

update.exe.pdb

advapi32

AdjustTokenPrivileges BuildTrusteeWithSidW ConvertSidToStringSidW ConvertStringSidToSidW CreateProcessAsUserW DuplicateTokenEx GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetTokenInformation GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle InitializeAcl InitializeSecurityDescriptor IsValidAcl IsValidSecurityDescriptor IsValidSid LookupAccountNameW LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegisterTraceGuidsW SetEntriesInAclW SetNamedSecurityInfoW SetSecurityDescriptorDacl SetSecurityInfo SystemFunction036 TraceEvent UnregisterTraceGuids

shell32

CommandLineToArgvW ord680 SHChangeNotify SHGetFolderPathW SHGetKnownFolderPath SHGetSpecialFolderLocation SHGetSpecialFolderPathW ShellExecuteExW

shlwapi

PathFileExistsW PathFindFileNameW PathMatchSpecW SHSetValueW StrStrIW

user32

AllowSetForegroundWindow CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetActiveWindow GetQueueStatus GetShellWindow GetWindowThreadProcessId KillTimer MessageBoxW MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RegisterClassExW SendMessageTimeoutW SetTimer SystemParametersInfoW TranslateMessage UnregisterClassW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AssignProcessToJobObject CloseHandle CompareStringW CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalDriveStringsW GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadId GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultUILanguage GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleFileNameExW K32GetModuleInformation K32GetProcessImageFileNameW K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA PostQueuedCompletionStatus Process32FirstW Process32NextW QueryDosDeviceW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrlenA

ole32

CoCreateInstance CoInitialize CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoTaskMemFree CoUninitialize

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

Name

.text

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

268KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

59KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

168B

Characteristics

Name

.tls

Size

512B

Virtual Size

489B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

118KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.newname

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-01-16_6de2f633f433c350a42d705ffcb839e1_cobalt-strike_icedid_njrat_ryuk_satacom_vidar.exe

advapi32

shell32

shlwapi

user32

kernel32

ole32

wtsapi32

generic