2026-06-28_bdca449dc54f3dde210c4c5644e97b40_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-28_bdca449dc54f3dde210c4c5644e97b40_cobalt-strike_icedid_njrat_vidar
Size 955KB
Sample260628-x4wrpscv31
SHA256 a5ca48c91054e753c72676d719fd4c4ee810df09f561b12cf1c8d959ca1d5217
MD5 bdca449dc54f3dde210c4c5644e97b40
SHA1 327594f0eaff46eaaf71effce21cd3236ec517eb
SHA512 2f0ccb1d7993e9c056687697ace3e21460e9c001e382af9e81cd2065e00bd4c3dea613e35a79f68701abd2a0c9b68de2f7f480054bb0f5695380e03ea1a66a1e
SSDEEP 12288:qWE64y4d4tn9xiiPMwmbkurRRD+YEtDYnYG:2CB9gembkuHDPExYnf
TLSH
T10B259F5537E812D2E1B7923D8AA9CB99E97178104730A7CB01E582AD3F23BD44E3E725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-06-28_bdca449dc54f3dde210c4c5644e97b40_cobalt-strike_icedid_njrat_vidar

.exe 955KB

2026-06-28_bdca449dc54f3dde210c4c5644e97b40_cobalt-strike_icedid_njrat_vidar

IMPHASH 35183cea407883c8fcd73669c0a3536a
SHA256 a5ca48c91054e753c72676d719fd4c4ee810df09f561b12cf1c8d959ca1d5217
MD5 bdca449dc54f3dde210c4c5644e97b40
SHA1 327594f0eaff46eaaf71effce21cd3236ec517eb
SHA512 2f0ccb1d7993e9c056687697ace3e21460e9c001e382af9e81cd2065e00bd4c3dea613e35a79f68701abd2a0c9b68de2f7f480054bb0f5695380e03ea1a66a1e
SSDEEP 12288:qWE64y4d4tn9xiiPMwmbkurRRD+YEtDYnYG:2CB9gembkuHDPExYnf
TLSH
T10B259F5537E812D2E1B7923D8AA9CB99E97178104730A7CB01E582AD3F23BD44E3E725
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

51:09:f6:6c:5b:dd:45:dd:70:a3:f2:83:ae:24:f3:4d:a9:9b:65:59:b6:e6:ec:71:2f:2e:b4:b4:63:1f:f5:00

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Defender Advanced Threat Protection,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 28, 2026

CN=Microsoft Windows Defender Advanced Threat Protection,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Defender Advanced Threat Protection,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:02:73:66:91:ce:1e:b6:d6:40:00:00:00:00:02:02

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:28:f0:a5:87:d7:f3:c8:1e:40:00:01:00:00:02:28

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

13636

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\1\s\exe\x64\Release Console\NotMyFaultC64.pdb

version

VerQueryValueW VerQueryValueA GetFileVersionInfoW GetFileVersionInfoA GetFileVersionInfoSizeW GetFileVersionInfoSizeA

kernel32

GetCurrentProcess GetSystemInfo GetTickCount GetPhysicallyInstalledSystemMemory FreeLibrary LoadResource LockResource SizeofResource LoadLibraryA FormatMessageA FindResourceA Sleep GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose CreateEventA WaitForSingleObject DeviceIoControl SetFileAttributesA DeleteFileA VerSetConditionMask GetEnvironmentVariableA CloseHandle GetLastError CreateFileA LoadLibraryExA GetVersionExA SetLastError LocalFree LocalAlloc GetProcAddress GetModuleHandleA GetCommandLineW GetStdHandle GetModuleFileNameW GetModuleFileNameA GetFileType GetProcessHeap SetConsoleCtrlHandler HeapSize HeapReAlloc WriteConsoleW SetEndOfFile VerifyVersionInfoW RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader SetStdHandle ExitProcess GetModuleHandleExW GetConsoleCP CreateThread ExitThread ResumeThread FreeLibraryAndExitThread WriteFile GetCommandLineA HeapAlloc HeapFree GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetCurrentThread FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WideCharToMultiByte CreateFileW SetConsoleMode GetNumberOfConsoleInputEvents ReadConsoleInputW PeekConsoleInputA ReadConsoleW GetFileSizeEx SetFilePointerEx OutputDebugStringW

user32

wsprintfA LoadCursorA InflateRect GetSysColorBrush SetCursor SetWindowTextA GetDlgItem EndDialog SendMessageA DialogBoxIndirectParamA

gdi32

StartPage EndDoc StartDocA SetMapMode GetDeviceCaps EndPage

comdlg32

PrintDlgA

advapi32

RegGetValueA RegFlushKey RegDeleteValueA LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken StartServiceA OpenServiceA OpenSCManagerA DeleteService CreateServiceA ControlService CloseServiceHandle RegSetValueExA RegQueryValueExW RegQueryValueExA RegOpenKeyExA RegOpenKeyA RegCreateKeyA RegCloseKey

Name

.text

Size

651KB

Virtual Size

651KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

132KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

671B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-28_bdca449dc54f3dde210c4c5644e97b40_cobalt-strike_icedid_njrat_vidar

version

kernel32

user32

gdi32

comdlg32

advapi32

generic