2026-10-01_0b3ced8675b7a8541d7a44b246dba930_cobalt-strike_icedid_njrat_satacom_vidar
UAC bypass, C2, browser theft
Native DLL staging includes removal of the staged libraryCMSTPLUA UAC bypass via COM moniker
SHA-25668c2d109c7b3d7a8d8ab577924a6726c4a0a16d2a3805bd20b1f184651c797cc
Evidence
⋯7 more rows
0x39cb0f45db4d8b1b4d01fb41ffe34531db42.E.M..M..A..E1.B
0x39db813c1750450000410f95c349c1e3084f.<.PE..A...I...O
0x39eb8b5c18084d01fb31db41ffe3468bac17.\..M..1.A..F...
⋯15 more rows
⋯7 more rows
0xf56cf0000e8ae020000cccc4883ec184c8bc1.........H...L..
0xf56dfb84d5a000066390515a9f0ff75784863.MZ..f9.....uxHc
0xf56ef0d48a9f0ff488d1505a9f0ff4803ca81.H...H......H...
0xf56ff3950450000755fb80b020000663941189PE..u_.....f9A.
0xf570f75544c2bc20fb74114488d51184803d0uTL+...A.H.Q.H..
⋯13 more rows
⋯6 more rows
0x110966121200000000000000009a9a9a9a0000................
0x11097600000000000000000000620063007200..........b.c.r.
0x1109867900700074002e0064006c006c000000y.p.t...d.l.l...
0x11099653004800410032003500360000004f00S.H.A.2.5.6...O.
⋯6 more rows
0x110a0600000000000000000000010000000000................
0x110a160000000000000000000045006c006500..........E.l.e.
0x110a2676006100740069006f006e003a004100v.a.t.i.o.n.:.A.
0x110a3664006d0069006e006900730074007200d.m.i.n.i.s.t.r.
0x110a46610074006f00720021006e0065007700a.t.o.r.!.n.e.w.
0x110a563a007b00330045003500460043003700:.{.3.E.5.F.C.7.
0x110a66460039002d0039004100350031002d00F.9.-.9.A.5.1.-.
0x110a7634003300360037002d003900300036004.3.6.7.-.9.0.6.
0x110a8633002d004100310032003000320034003.-.A.1.2.0.2.4.
0x110a963400460042004500430037007d0000004.F.B.E.C.7.}...
0x110aa60000746ddd6e07c0754eb76ae5740995..tm.n..uN.j.t..
0x110ab6e24c00000000000000002d002d006500.L........-.-.e.
⋯10 more rows
⋯3 more rows
0x1313ae746c0000b500696e65745f6e746f7000tl....inet_ntop.
0x1313be5753325f33322e646c6c0000fc00456eWS2_32.dll....En
0x1313ce756d446973706c617944657669636573umDisplayDevices
⋯3 more rows
0x13140ef80147657457696e646f775468726561..GetWindowThrea
0x13141e6450726f63657373496400009d024f70dProcessId....Op
0x13142e656e436c6970626f6172640036014765enClipboard.6.Ge
0x13143e74436c6970626f617264446174610000tClipboardData..
0x13144e4f00436c6f7365436c6970626f617264O.CloseClipboard
0x13145e00005000436c6f73654465736b746f70..P.CloseDesktop
0x13146e00009e024f70656e4465736b746f7041....OpenDesktopA
0x13147e000062004372656174654465736b746f..b.CreateDeskto
0x13148e70410000cc0147657454687265616444pA....GetThreadD
0x13149e65736b746f7000006703536574546872esktop..g.SetThr
0x1314ae6561644465736b746f700000c7014765eadDesktop....Ge
0x1314be7453797374656d4d6574726963730000tSystemMetrics..
⋯5 more rows
0x13151e47657457696e646f775265637400b302GetWindowRect...
0x13152e5072696e7457696e646f7700e3035769PrintWindow...Wi
0x13153e6e646f7746726f6d506f696e74000903ndowFromPoint...
⋯7 more rows
0x1315be696e646f77506c6163656d656e740000indowPlacement..
0x1315ce4702497357696e646f7700007b024d61G.IsWindow..{.Ma
0x1315de705669727475616c4b65794100003001pVirtualKeyA..0.
0x1315ee476574436c6173734e616d6541005553GetClassNameA.US
0x1315fe455233322e646c6c0000310043726561ER32.dll..1.Crea
0x13160e7465436f6d70617469626c6544430000teCompatibleDC..
0x13161e3000437265617465436f6d70617469620.CreateCompatib
0x13162e6c654269746d61700000640353656c65leBitmap..d.Sele
0x13163e63744f626a65637400005a0043726561ctObject..Z.Crea
⋯3 more rows
⋯7 more rows
0x132ff000000000000000000000000000000000................
0x1330006400000032000000c63141579e9cd7afd...2....1AW....
0x133010f73141579e9cd7afc8a6a16bb1e5b704.1AW.......k....
0x13302027b865f661bc06ef55f674f661bc06ef'.e.a...U.t.a...
⋯15 more rows