2026-04-17_93f1423d60090987402e503fc074eb37_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-17_93f1423d60090987402e503fc074eb37_cobalt-strike_icedid_njrat_vidar
Size 763KB
Sample260417-ej8xeshy61
SHA256 2ec13429d99bbcbd6c9997959ec5fdac7a9983b73a103cebe5c5bbad4f6b6aa3
MD5 93f1423d60090987402e503fc074eb37
SHA1 1400239cc6091a73677c00840c77eae412791c45
SHA512 6bc2e6f6750f76e2f1638ad0d728bd04e76b136cb05f29dbfa85b4fb9387028f2897ae30d3b0a68fcfb8a6c25c8ed90e070a2c007249b0f2248fe90afd34ff70
SSDEEP 12288:fmw5HEjsChNdBFgl0W8m+CGeTB6640wP1M5N7tba4InDtqUh1+txVPMBb5hMpZ/T:ewuQOWqC43NM5NxO4InDtqUh1+tLg9+j
TLSH
T150F4AE4D71A34FDBDB728D388F654131BB72B45629579A2B03E0C20E2F77290BD16A23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-17_93f1423d60090987402e503fc074eb37_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-04-17_93f1423d60090987402e503fc074eb37_cobalt-strike_icedid_njrat_vidar

.exe 763KB

2026-04-17_93f1423d60090987402e503fc074eb37_cobalt-strike_icedid_njrat_vidar

IMPHASH 82aaeb59d4a73a4deeb6faa3fe26ddf6
SHA256 2ec13429d99bbcbd6c9997959ec5fdac7a9983b73a103cebe5c5bbad4f6b6aa3
MD5 93f1423d60090987402e503fc074eb37
SHA1 1400239cc6091a73677c00840c77eae412791c45
SHA512 6bc2e6f6750f76e2f1638ad0d728bd04e76b136cb05f29dbfa85b4fb9387028f2897ae30d3b0a68fcfb8a6c25c8ed90e070a2c007249b0f2248fe90afd34ff70
SSDEEP 12288:fmw5HEjsChNdBFgl0W8m+CGeTB6640wP1M5N7tba4InDtqUh1+txVPMBb5hMpZ/T:ewuQOWqC43NM5NxO4InDtqUh1+tLg9+j
TLSH
T150F4AE4D71A34FDBDB728D388F654131BB72B45629579A2B03E0C20E2F77290BD16A23
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

88032

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

d:\dbs\el\dec\target\x64\ship\delivery\x-none\ose.pdb

advapi32

RegOpenKeyExW RegEnumKeyExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegEnumValueW SetThreadToken RegSetValueExW StartServiceCtrlDispatcherW SetServiceStatus RegNotifyChangeKeyValue DuplicateToken GetUserNameA RegDeleteValueW RegisterServiceCtrlHandlerW CryptGetHashParam CryptDestroyHash CryptHashData CryptCreateHash LookupAccountNameW ConvertStringSecurityDescriptorToSecurityDescriptorW CheckTokenMembership FreeSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken CryptReleaseContext CryptAcquireContextW SetFileSecurityW RegDeleteKeyW OpenThreadToken

kernel32

GetModuleFileNameW GetLastError SetEvent CloseHandle GetLogicalDrives lstrlenW lstrcmpW GetDriveTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection Sleep DeleteCriticalSection ExitProcess GetCommandLineW SetErrorMode CreateMutexW WaitForMultipleObjectsEx ReleaseMutex CreateEventW GetSystemInfo ResetEvent MoveFileExW CreateProcessW GetModuleHandleW GetTickCount ReadFile SetFilePointer CreateFileW MultiByteToWideChar CreateFileA RaiseException GetProcAddress FreeLibrary WideCharToMultiByte DosDateTimeToFileTime LoadLibraryExW ReleaseSemaphore WaitForMultipleObjects WaitForSingleObject CreateThread CreateSemaphoreW VirtualFree VirtualAlloc GlobalAlloc GlobalFree SetFilePointerEx GetSystemTimeAsFileTime CompareStringW ExpandEnvironmentStringsW WriteFile SetFileTime SetEndOfFile SystemTimeToFileTime GetSystemTime LocalFree FindClose GetTempPathA CreateDirectoryW GetTempPathW GetFileAttributesW FindFirstFileW GetFileSizeEx QueryPerformanceCounter DeleteFileW GetTimeZoneInformation SystemTimeToTzSpecificLocalTime GetStdHandle lstrlenA FindNextFileW RemoveDirectoryW SetFileAttributesW GetCurrentProcess GetFileAttributesExW GetWindowsDirectoryW CopyFileW GetFileTime GetComputerNameW FormatMessageA GetCurrentThread HeapFree HeapSize HeapReAlloc HeapAlloc GetProcessHeap LoadLibraryExA VirtualQuery VirtualProtect WriteConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers LCMapStringW GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree RtlPcToFileHeader GetModuleHandleExW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA

rpcrt4

RpcServerUseProtseqEpW RpcServerUnregisterIf RpcServerRegisterIfEx RpcImpersonateClient RpcRevertToSelf NdrServerCall2

wintrust

WinVerifyTrust

Name

.text

Size

164KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

400KB

Virtual Size

740KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

zdYZXvWR

Size

123KB

Virtual Size

122KB

Characteristics

Name

HmUulHIT

Size

2KB

Virtual Size

2KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-17_93f1423d60090987402e503fc074eb37_cobalt-strike_icedid_njrat_vidar

advapi32

kernel32

rpcrt4

wintrust

generic