2026-05-31_c5a7dea95d9d8babab35d903c6e89258_amadey_cobalt-strike_hijackloader_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-31_c5a7dea95d9d8babab35d903c6e89258_amadey_cobalt-strike_hijackloader_icedid_njrat_vidar
Size 1.7MB
Sample260531-ssvytabs8s
SHA256 396c1de45df4677af196909b11cca881d7199471628cb283003ac62780d58f66
MD5 c5a7dea95d9d8babab35d903c6e89258
SHA1 aab992a50645d15ef6052352cc069365a13809d2
SHA512 99b56598b0d4215a8ce60ea6f463e6c0358a4fec5bad33099644202a21b335973f399986b817c0169cf591c948a2a8749a6a92b976fca5e070e9328fae68841f
SSDEEP 12288:hTjkWIw2JK/ZyPz5L86qNrODyL33FolSjyx1gL5pRTcAkS/3hzN8qE43fm78V:hTiw24gzynOm3FolSjyA5jcAkSYqyE
TLSH
T10785A40566A44971D462D2348591AA8DA6733C44EB338E8F2182BEEEFFF37914D36731
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-31_c5a7dea95d9d8babab35d903c6e89258_amadey_cobalt-strike_hijackloader_icedid_njrat_vidar

File Explorer

2026-05-31_c5a7dea95d9d8babab35d903c6e89258_amadey_cobalt-strike_hijackloader_icedid_njrat_vidar

.exe 1.7MB

2026-05-31_c5a7dea95d9d8babab35d903c6e89258_amadey_cobalt-strike_hijackloader_icedid_njrat_vidar

IMPHASH 1554dc6dbc2e5d878c14e034182ba418
SHA256 396c1de45df4677af196909b11cca881d7199471628cb283003ac62780d58f66
MD5 c5a7dea95d9d8babab35d903c6e89258
SHA1 aab992a50645d15ef6052352cc069365a13809d2
SHA512 99b56598b0d4215a8ce60ea6f463e6c0358a4fec5bad33099644202a21b335973f399986b817c0169cf591c948a2a8749a6a92b976fca5e070e9328fae68841f
SSDEEP 12288:hTjkWIw2JK/ZyPz5L86qNrODyL33FolSjyx1gL5pRTcAkS/3hzN8qE43fm78V:hTiw24gzynOm3FolSjyA5jcAkSYqyE
TLSH
T10785A40566A44971D462D2348591AA8DA6733C44EB338E8F2182BEEEFFF37914D36731
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

136432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

Dism.pdb

msvcrt

_wcsnicmp iswalpha ??0exception@@QEAA@XZ towlower _errno wcsncmp __dllonexit _unlock _lock ??1type_info@@UEAA@XZ ?terminate@@YAXXZ _commode _fmode _initterm __setusermatherr _cexit _exit exit __set_app_type __wgetmainargs _amsg_exit _XcptFilter _CxxThrowException _callnewh ??0exception@@QEAA@AEBQEBDH@Z wcscpy_s wcsrchr calloc malloc _purecall ??0exception@@QEAA@AEBQEBD@Z ?what@exception@@UEBAPEBDXZ ??1exception@@UEAA@XZ ??0exception@@QEAA@AEBV0@@Z _wcsicmp free _vsnwprintf towupper _getwch vswprintf_s _vscwprintf _wcslwr_s wcschr wprintf memmove_s memcpy_s __C_specific_handler wcsstr realloc memset _onexit __CxxFrameHandler3 memcpy memcmp __RTDynamicCast wcscmp

advapi32

RegisterTraceGuidsW IsValidSecurityDescriptor GetAclInformation InitializeAcl AddAce SetSecurityDescriptorDacl SetSecurityDescriptorGroup MakeAbsoluteSD GetSecurityDescriptorControl GetSecurityDescriptorGroup GetSecurityDescriptorDacl GetSecurityDescriptorSacl GetSecurityDescriptorOwner InitializeSecurityDescriptor SetSecurityDescriptorOwner GetSidLengthRequired InitializeSid GetSidSubAuthority IsValidSid CopySid GetLengthSid RegQueryValueExW RegOpenKeyExW RegCloseKey AdjustTokenPrivileges GetTraceEnableLevel GetTraceEnableFlags GetTraceLoggerHandle EventUnregister EventRegister EventWriteTransfer EventActivityIdControl UnregisterTraceGuids InitiateSystemShutdownExW OpenProcessToken LookupPrivilegeValueW TraceEvent

kernel32

SearchPathW UnmapViewOfFile CreateFileMappingW MapViewOfFile GetFileInformationByHandleEx DeviceIoControl SetFileAttributesW SetFileInformationByHandle DeleteFileW CopyFileExW GetFinalPathNameByHandleW GetDriveTypeW GetVersionExW GetProcAddress GetModuleHandleW GetModuleHandleExW FreeLibrary InitializeCriticalSection EnterCriticalSection SetEvent LeaveCriticalSection GetLastError CloseHandle SetThreadUILanguage SetErrorMode SetConsoleCtrlHandler OutputDebugStringW GetCommandLineW HeapFree GetProcessHeap Sleep GetCurrentProcess DeleteCriticalSection RaiseException GetCurrentThreadId CompareStringW GetStdHandle HeapAlloc WriteConsoleW LocalAlloc WideCharToMultiByte WriteFile LocalFree GetFileType GetConsoleMode SizeofResource LockResource LoadResource FindResourceExW GetModuleFileNameW IsWow64Process FormatMessageW GetFileAttributesW SetLastError CreateFileW GetSystemInfo HeapSize HeapReAlloc HeapDestroy MultiByteToWideChar WaitForSingleObject SetUnhandledExceptionFilter QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetTickCount RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess OutputDebugStringA GetSystemWindowsDirectoryW ExpandEnvironmentStringsW GetTempFileNameW GetFullPathNameW CreateDirectoryW GetFileInformationByHandle FindFirstFileW FindNextFileW FindClose LoadLibraryExW

ole32

CoInitializeSecurity CoUninitialize CoInitializeEx CoCreateInstance

user32

CharLowerBuffW

oleaut32

SysAllocStringLen GetErrorInfo SysAllocString SysAllocStringByteLen VarBstrCmp SysStringByteLen LoadTypeLi LoadRegTypeLi SysFreeString VariantClear SysStringLen

version

GetFileVersionInfoExW VerQueryValueW GetFileVersionInfoSizeExW

ntdll

RtlGetVersion RtlNtStatusToDosError NtSetInformationFile RtlFreeHeap RtlAllocateHeap

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-31_c5a7dea95d9d8babab35d903c6e89258_amadey_cobalt-strike_hijackloader_icedid_njrat_vidar

msvcrt

advapi32

kernel32

ole32

user32

oleaut32

version

ntdll

generic