2026-07-09_db9c1405ca03e900ce32fcba5f8d7c84_cobalt-strike_icedid_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-09_db9c1405ca03e900ce32fcba5f8d7c84_cobalt-strike_icedid_vidar
Size 827KB
Sample260709-pavnjsay2w
SHA256 0c62e40561984bbccc566ae6adcf780c5d13b44cc6a9e16d9438f6681c30f445
MD5 db9c1405ca03e900ce32fcba5f8d7c84
SHA1 b20e7a3dfdf2375de7de3995cbc9a5d2a076f3af
SHA512 edc01316665eb7fd451e84ef386bfac6b56b736446e08b938eb7feaf6e07a9015c5f49dcc9938276a05f30e629a1b92acf62dca71548fbe88f73ed991bc83340
SSDEEP 12288:igXZ86a0vw0KfQn1lfKS5YcI+mN+EXCPMZ5y7BqHmqkfMXzN4g2:igJ86aUdr1gS5YwWXCPOyIGLf4pI
TLSH
T1D2057C2ABFA841F8D177C179C9528657F3F2B8560A349B5F12E4436E2F272605F2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-09_db9c1405ca03e900ce32fcba5f8d7c84_cobalt-strike_icedid_vidar

File Explorer

2026-07-09_db9c1405ca03e900ce32fcba5f8d7c84_cobalt-strike_icedid_vidar

.exe 827KB

2026-07-09_db9c1405ca03e900ce32fcba5f8d7c84_cobalt-strike_icedid_vidar

IMPHASH 6df40dd4f907db760141b0da2b2e1ab9
SHA256 0c62e40561984bbccc566ae6adcf780c5d13b44cc6a9e16d9438f6681c30f445
MD5 db9c1405ca03e900ce32fcba5f8d7c84
SHA1 b20e7a3dfdf2375de7de3995cbc9a5d2a076f3af
SHA512 edc01316665eb7fd451e84ef386bfac6b56b736446e08b938eb7feaf6e07a9015c5f49dcc9938276a05f30e629a1b92acf62dca71548fbe88f73ed991bc83340
SSDEEP 12288:igXZ86a0vw0KfQn1lfKS5YcI+mN+EXCPMZ5y7BqHmqkfMXzN4g2:igJ86aUdr1gS5YwWXCPOyIGLf4pI
TLSH
T1D2057C2ABFA841F8D177C179C9528657F3F2B8560A349B5F12E4436E2F272605F2E321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

502100

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

DeleteFileW GetWindowsDirectoryW GetCurrentProcessId GetTickCount FindFirstFileW FindNextFileW FindClose GetFileAttributesW GetModuleHandleA GetLogicalDriveStringsW ReadFile WriteFile DeviceIoControl SetFilePointer SetEndOfFile GetFileSize GetFileInformationByHandle GetVolumeInformationW GetDiskFreeSpaceW GetDriveTypeW GetCurrentProcess FileTimeToSystemTime GetProcessAffinityMask GetSystemInfo GlobalMemoryStatusEx GetSystemTimeAsFileTime GetStdHandle WaitForMultipleObjects QueryPerformanceCounter SetProcessAffinityMask UnmapViewOfFile MapViewOfFile IsProcessorFeaturePresent GetCommandLineW GetConsoleMode GetLogicalDrives GetFileSizeEx Sleep CreateFileMappingW GetFullPathNameW ExpandEnvironmentStringsW GetUserDefaultUILanguage SetErrorMode CreateMutexW ReleaseMutex GetACP OpenProcess AttachConsole GetCurrentThread QueryPerformanceFrequency GlobalAlloc GetNativeSystemInfo GetLocalTime GetThreadContext FreeLibrary SetFileAttributesW LCMapStringW GetComputerNameW CreateProcessW GetFileType SetProcessWorkingSetSize GlobalUnlock MulDiv HeapFree TerminateProcess GetProcessHeap GetExitCodeThread HeapSize WriteConsoleW SetFilePointerEx SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW GetStringTypeW HeapReAlloc GetConsoleCP FlushFileBuffers HeapAlloc ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx VirtualProtect InitializeSListHead GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LoadLibraryW GetCurrentThreadId CreateFileW GetTempPathW SetLastError CreateDirectoryW ReplaceFileW WideCharToMultiByte GetModuleFileNameW MultiByteToWideChar CreateSemaphoreW ResetEvent CloseHandle SetEvent GetLastError CreateEventW WaitForSingleObject InitializeCriticalSection ReleaseSemaphore DeleteCriticalSection LeaveCriticalSection EnterCriticalSection LoadLibraryExW GetSystemDirectoryW GetModuleHandleW GetProcAddress VirtualAlloc GlobalLock VirtualFree

user32

PostQuitMessage SystemParametersInfoW DialogBoxParamW LoadImageW ReleaseDC GetCursorPos BeginPaint EndPaint EnableWindow wsprintfW CharUpperW CallWindowProcW GetMessageW DefWindowProcW ModifyMenuW ShowWindowAsync SetWindowLongPtrW PostMessageW GetMenu DestroyWindow GetDC IsWindowVisible SetWindowPos MessageBoxW CheckRadioButton MessageBoxExW EnumChildWindows FillRect CreateWindowExW ScreenToClient SendMessageW EndDialog GetSystemMetrics UnregisterClassW SetWindowTextW CreatePopupMenu RegisterClassExW IsWindow OpenClipboard DispatchMessageW DestroyIcon ClientToScreen CloseClipboard EmptyClipboard SetDlgItemTextW GetDlgItemTextW IsDlgButtonChecked SetLayeredWindowAttributes TranslateMessage LoadIconW LoadCursorW SetClipboardData TrackPopupMenuEx GetClientRect GetDlgItem AppendMenuW DrawTextW

gdi32

SelectObject CreateFontW GetStockObject GetDeviceCaps SetTextColor SetBkMode DeleteObject CreateSolidBrush CreateFontIndirectW

comdlg32

GetSaveFileNameW

advapi32

StartServiceW AdjustTokenPrivileges LookupPrivilegeValueW SystemFunction036 RegQueryValueExW RegCloseKey CloseServiceHandle OpenSCManagerW RegEnumKeyExW OpenProcessToken RegOpenKeyExW OpenServiceW QueryServiceStatusEx

shell32

CommandLineToArgvW SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW DragFinish DragQueryFileW

ole32

StringFromGUID2 CoInitializeEx IIDFromString CoTaskMemFree CoCreateInstance CoUninitialize

oleaut32

SysFreeString SysAllocString VariantCopy SysAllocStringLen VariantClear

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

newdev

UpdateDriverForPlugAndPlayDevicesW

comctl32

ImageList_SetOverlayImage ImageList_Create ImageList_ReplaceIcon ord410 InitCommonControlsEx ImageList_Destroy ord413

setupapi

CM_Uninstall_DevNode SetupDiEnumDeviceInfo CM_Get_Parent SetupDiGetClassDevsW CM_Get_DevNode_Registry_PropertyW SetupDiGetClassDescriptionW CM_Disable_DevNode SetupDiCallClassInstaller CM_Get_Child CM_Get_Device_IDW CM_Get_Device_ID_ListW CM_Get_Sibling CM_Locate_DevNodeW CM_Open_DevNode_Key SetupUninstallOEMInfW CM_Reenumerate_DevNode CM_Open_Class_KeyW CM_Enable_DevNode CM_Get_Device_ID_List_SizeW SetupDiLoadClassIcon SetupDiDestroyDeviceInfoList CM_Get_DevNode_Status

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-09_db9c1405ca03e900ce32fcba5f8d7c84_cobalt-strike_icedid_vidar

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

version

newdev

comctl32

setupapi

generic