2026-11-11_219cdf4aed68b7edac13af04a64c0e97_cobalt-strike_icedid_njrat_satacom_vidar

General

Target
2026-11-11_219cdf4aed68b7edac13af04a64c0e97_cobalt-strike_icedid_njrat_satacom_vidar
Size 1.5MB
Sample261113-tevxbsdt2z
SHA256 e7922cfe83c1c0e1f00dbaa71232f22dcad5ebc2f7248b135ceb903c3888e223
MD5 219cdf4aed68b7edac13af04a64c0e97
SHA1 8eab79a2456f8e1db1eb95f4e2b077d249a8b2ea
SHA512 24eacc2e3739fd4f3a3722b82bcc284b1516c3c9a8292e753e55c3436227631f92dbb0bed2380cb7a964879d046400073c7918bd93e758c698bdc05a7f56d251
SSDEEP 24576:Cr75t4yaaI/Ri8yJsqjnhMgeiCl7G0nehbGZpbD:EQjJqDmg27RnWGj
TLSH
T1BA75F15AF2A814F9E473813CC9969906E6727C1707308AEF23E146567F376E05E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_219cdf4aed68b7edac13af04a64c0e97_cobalt-strike_icedid_njrat_satacom_vidar

File Explorer

2026-11-11_219cdf4aed68b7edac13af04a64c0e97_cobalt-strike_icedid_njrat_satacom_vidar

.exe 1.5MB

2026-11-11_219cdf4aed68b7edac13af04a64c0e97_cobalt-strike_icedid_njrat_satacom_vidar

IMPHASH d38db9c279ebc9dbeff78b6ddfd5cab9
SHA256 e7922cfe83c1c0e1f00dbaa71232f22dcad5ebc2f7248b135ceb903c3888e223
MD5 219cdf4aed68b7edac13af04a64c0e97
SHA1 8eab79a2456f8e1db1eb95f4e2b077d249a8b2ea
SHA512 24eacc2e3739fd4f3a3722b82bcc284b1516c3c9a8292e753e55c3436227631f92dbb0bed2380cb7a964879d046400073c7918bd93e758c698bdc05a7f56d251
SSDEEP 24576:Cr75t4yaaI/Ri8yJsqjnhMgeiCl7G0nehbGZpbD:EQjJqDmg27RnWGj
TLSH
T1BA75F15AF2A814F9E473813CC9969906E6727C1707308AEF23E146567F376E05E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

78176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\MyPrograms\CCECamera_WinDriverUtil\x64\Release\CCECamera_WinDriverUtil.pdb

advapi32

OpenProcessToken GetTokenInformation

kernel32

GetCurrentProcess GetLastError CloseHandle GetCurrentDirectoryW CreateFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW SetEndOfFile SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte LocalFree FormatMessageA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW WriteConsoleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx GetFileType HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode DeleteFileW WaitForSingleObject GetExitCodeProcess CreateProcessW ReadFile ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize RtlUnwind

Name

.text

Size

224KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_219cdf4aed68b7edac13af04a64c0e97_cobalt-strike_icedid_njrat_satacom_vidar

advapi32

kernel32

generic