2026-07-03_8e7d44e65f02f1b14c7219cd0f803901_cobalt-strike_icedid_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_8e7d44e65f02f1b14c7219cd0f803901_cobalt-strike_icedid_njrat_stealc_vidar
Size 1.7MB
Sample260703-tal4mact3y
SHA256 da6d655d77846f5b40a5521f63c12cb848c0fcc4cff86147dbe46badf0017afa
MD5 8e7d44e65f02f1b14c7219cd0f803901
SHA1 9a3881655d60e2d073b63548fcdb05b6ea0946a6
SHA512 b3a590bf098170c99d80699363ec7c180f9ae7aebdaf9e29941188cf40da8a76bc5385c649ddf785d1e7be2da50d977cd9c93f9783a52b15109d5d9637b1a74b
SSDEEP 24576:1k5vJSby7cxzcbPtxsqjnhMgeiCl7G0nehbGZpbD:gvQbgcxwXDmg27RnWGj
TLSH
T1C185D09A736805F5E06A807CCA438A0BE672381957609BDF02E4D7BA2F375D15E3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-03_8e7d44e65f02f1b14c7219cd0f803901_cobalt-strike_icedid_njrat_stealc_vidar

File Explorer

2026-07-03_8e7d44e65f02f1b14c7219cd0f803901_cobalt-strike_icedid_njrat_stealc_vidar

.exe 1.7MB

2026-07-03_8e7d44e65f02f1b14c7219cd0f803901_cobalt-strike_icedid_njrat_stealc_vidar

IMPHASH 2af4e1196c69df31274f7f1e5838bb94
SHA256 da6d655d77846f5b40a5521f63c12cb848c0fcc4cff86147dbe46badf0017afa
MD5 8e7d44e65f02f1b14c7219cd0f803901
SHA1 9a3881655d60e2d073b63548fcdb05b6ea0946a6
SHA512 b3a590bf098170c99d80699363ec7c180f9ae7aebdaf9e29941188cf40da8a76bc5385c649ddf785d1e7be2da50d977cd9c93f9783a52b15109d5d9637b1a74b
SSDEEP 24576:1k5vJSby7cxzcbPtxsqjnhMgeiCl7G0nehbGZpbD:gvQbgcxwXDmg27RnWGj
TLSH
T1C185D09A736805F5E06A807CCA438A0BE672381957609BDF02E4D7BA2F375D15E3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qb\workspace\21461\source\output\dump64\miniport\IntelCpLSPCONSvc\Release\IntelCpHDCPSvc.pdb

kernel32

GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW ReadFile WriteFile ReleaseMutex GetCommandLineW CreateFileW HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap SleepEx GetCurrentProcess FlushFileBuffers GetModuleFileNameW FindClose GetConsoleOutputCP GetConsoleMode SetFilePointerEx LCMapStringW GetCurrentThreadId OutputDebugStringA CreateThread CreateSemaphoreExW ReleaseSemaphore SetEvent CloseHandle WriteConsoleW GetVersion LoadLibraryW GetProcAddress GetCurrentProcessId DeleteCriticalSection FlsFree FlsSetValue FlsGetValue FreeLibrary EnterCriticalSection LeaveCriticalSection GetModuleHandleW LoadLibraryExW LoadResource SizeofResource FindResourceW lstrcmpiW MultiByteToWideChar InitializeCriticalSectionEx GetLastError RaiseException DecodePointer Sleep CreateEventW WaitForSingleObject QueryPerformanceFrequency FlsAlloc GetFileType GetStdHandle GetModuleHandleExW ExitProcess RtlPcToFileHeader WaitForMultipleObjects DeviceIoControl CreateMutexW QueryPerformanceCounter RtlUnwindEx CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle VirtualFree VirtualProtect TryEnterCriticalSection SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait EncodePointer GetCurrentThread GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA GetVersionExW VirtualAlloc

advapi32

LookupPrivilegeValueW RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW EventWrite RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey EventUnregister EventRegister NotifyServiceStatusChangeW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW AdjustTokenPrivileges OpenProcessToken

user32

GetWindowRect EnumChildWindows EnumDisplayDevicesW MessageBoxW IsChild CharUpperW PostThreadMessageW DispatchMessageW TranslateMessage GetMessageW LoadStringW GetDisplayConfigBufferSizes QueryDisplayConfig CharNextW

oleaut32

VariantInit VariantClear SafeArrayCopy SafeArrayUnlock SafeArrayLock SafeArrayGetLBound SafeArrayGetUBound SysFreeString SafeArrayRedim SafeArrayDestroy SafeArrayCreate LoadRegTypeLi LoadTypeLi VarUI4FromStr SysStringLen SafeArrayGetVartype

setupapi

CM_Get_Device_Interface_ListW CM_Get_Device_Interface_List_SizeW

ole32

CoCreateInstance CoInitializeSecurity CoInitializeEx CoUninitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoReleaseServerProcess CoAddRefServerProcess CoSetProxyBlanket CoRevokeClassObject OleRun

api-ms-win-devices-config-l1-1-1

CM_Unregister_Notification CM_Register_Notification CM_MapCrToWin32Err

ntdll

RtlInitAnsiString RtlFreeUnicodeString RtlAnsiStringToUnicodeString

Name

.text

Size

328KB

Virtual Size

328KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

121KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_8e7d44e65f02f1b14c7219cd0f803901_cobalt-strike_icedid_njrat_stealc_vidar

kernel32

advapi32

user32

oleaut32

setupapi

ole32

api-ms-win-devices-config-l1-1-1

ntdll

generic