2026-07-14_5ec719ca65829b10ea8b91157c176166_akira_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-14_5ec719ca65829b10ea8b91157c176166_akira_cobalt-strike_icedid_njrat_vidar
Size 3.4MB
Sample260714-xmw15set2y
SHA256 f7233baa61b81d9050a2fdc88989541f1758e1c2db8067d45d026280f46051ca
MD5 5ec719ca65829b10ea8b91157c176166
SHA1 29220477e4cfbc44497eaffd9db2ffef173bd5cf
SHA512 4ddfae54a2550756762006eb84fc115f4f275abc4dfa0736a90d06b29a36f0fcfc690ffe30752dee80564ae6a7a3d07342efab2df9f3744cb58bc63f28389df9
SSDEEP 49152:banYnyMqOkg9+xCDbGQOlc494+3RNGMbWyvxQoeJqdr1b9W7JVTV:uYnTluCGQ2cj+rp9W7T
TLSH
T159F59E5B72A901E8D177D17CCA475B06F6B274064731ABCF12A487AA1F27BE05E7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_5ec719ca65829b10ea8b91157c176166_akira_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-07-14_5ec719ca65829b10ea8b91157c176166_akira_cobalt-strike_icedid_njrat_vidar

.exe 3.4MB

2026-07-14_5ec719ca65829b10ea8b91157c176166_akira_cobalt-strike_icedid_njrat_vidar

IMPHASH c6a6ae003a2168700f7a051640c02499
SHA256 f7233baa61b81d9050a2fdc88989541f1758e1c2db8067d45d026280f46051ca
MD5 5ec719ca65829b10ea8b91157c176166
SHA1 29220477e4cfbc44497eaffd9db2ffef173bd5cf
SHA512 4ddfae54a2550756762006eb84fc115f4f275abc4dfa0736a90d06b29a36f0fcfc690ffe30752dee80564ae6a7a3d07342efab2df9f3744cb58bc63f28389df9
SSDEEP 49152:banYnyMqOkg9+xCDbGQOlc494+3RNGMbWyvxQoeJqdr1b9W7JVTV:uYnTluCGQ2cj+rp9W7T
TLSH
T159F59E5B72A901E8D177D17CCA475B06F6B274064731ABCF12A487AA1F27BE05E7E320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1314080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qba1\workspace\7210\SSE_Storage_Common\build\iaStorAfs\package\x64\Release\iaStorAfsService.pdb

kernel32

FindNextFileNameW LocalFree GetCommandLineA TlsSetValue CreateEventW ResetEvent Sleep WaitForMultipleObjects InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetModuleHandleW GetProcAddress CreateFileW DeviceIoControl GetCommandLineW MultiByteToWideChar InitializeCriticalSectionAndSpinCount FindFirstFileExW OutputDebugStringW QueryPerformanceCounter ReadFile WriteFile DeleteFileW GetModuleFileNameW GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentThread DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize GetTickCount64 CreateTimerQueue CreateTimerQueueTimer DeleteTimerQueueEx GetSystemDirectoryW FindFirstFileNameW GetFinalPathNameByHandleW OpenFileById FindFirstFileW FindNextFileW GetCurrentProcess SetPriorityClass DeleteTimerQueueTimer GetSystemPowerStatus HeapFree TryEnterCriticalSection CreateDirectoryW GetFileAttributesW SetFileAttributesW InitializeCriticalSection ExitProcess TlsAlloc TlsFree HeapReAlloc MoveFileW HeapAlloc HeapDestroy GetLastError CloseHandle DecodePointer WaitForSingleObject SetEvent SetEnvironmentVariableW HeapCreate GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile TlsGetValue CompareFileTime ExpandEnvironmentStringsW GetSystemTime SystemTimeToFileTime SuspendThread ResumeThread FindClose lstrlenW GetOverlappedResult CancelIoEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetSystemInfo VirtualAlloc VirtualProtect VirtualQuery CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW SetLastError GetCurrentThreadId HeapQueryInformation GetSystemTimeAsFileTime LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetFileType GetStartupInfoW RaiseException GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode WideCharToMultiByte IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW SetStdHandle SetConsoleCtrlHandler ReadConsoleW WriteConsoleW RtlUnwindEx RtlPcToFileHeader RtlUnwind FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InterlockedFlushSList ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetCurrentProcessId InitOnceExecuteOnce FormatMessageW LCMapStringEx GetLocaleInfoEx CompareStringEx SetFilePointer FileTimeToLocalFileTime GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW UnmapViewOfFile FileTimeToSystemTime HeapValidate GetTempPathA GetDiskFreeSpaceA LeaveCriticalSection AreFileApisANSI EnterCriticalSection GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetFileSize LockFileEx UnlockFile HeapCompact LoadLibraryW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetTimeZoneInformation

advapi32

DeregisterEventSource ReportEventW ConvertStringSecurityDescriptorToSecurityDescriptorW TraceMessage GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW RegisterEventSourceW QueryServiceStatusEx OpenServiceW ChangeServiceConfigW QueryServiceConfigW StartServiceW EnumDependentServicesW OpenThreadToken CopySid EqualSid GetLengthSid GetSidLengthRequired GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation InitializeSid IsValidSid ControlService DeleteService RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey ChangeServiceConfig2W OpenSCManagerW AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl CloseServiceHandle SetEntriesInAclW CreateServiceW RegDeleteTreeW RegCreateKeyExW

shlwapi

PathIsDirectoryW PathFileExistsW PathFindExtensionW PathFindFileNameW PathIsRelativeW PathRemoveFileSpecW

rpcrt4

NdrServerCallAll Ndr64AsyncServerCallAll NdrServerCall2 RpcImpersonateClient RpcRevertToSelf RpcBindingVectorFree RpcServerInqBindings RpcServerListen RpcServerRegisterIf3 RpcServerUnregisterIf RpcServerUseProtseqEpW RpcMgmtStopServerListening NdrAsyncServerCall RpcMgmtWaitServerListen RpcEpRegisterW RpcAsyncAbortCall RpcAsyncCompleteCall RpcServerTestCancel RpcEpUnregister

userenv

UnloadUserProfile

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

ole32

CoInitializeEx CoRegisterClassObject CoRevokeClassObject CoCreateInstance CoSetProxyBlanket CoUninitialize

oleaut32

SetErrorInfo SysFreeString VariantInit SysAllocString VariantClear CreateErrorInfo VariantChangeType GetErrorInfo

fltlib

FilterReplyMessage FilterGetMessage FilterSendMessage FilterConnectCommunicationPort

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification PowerSettingUnregisterNotification

user32

LoadStringW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

496KB

Virtual Size

495KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

41KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

112KB

Virtual Size

112KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=1, id=260, version=27032,

count=79, id=265, version=28105,

count=25, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=276, id=1, productName=Unmarked objects,

count=1, id=262, version=27412,

count=1, id=263, version=27412,

count=94, id=261, productName=VS2019 v16.2.3 build 27905, version=27905,

count=18, id=260, productName=VS2019 v16.2.3 build 27905, version=27905,

count=9, id=259, productName=VS2019 v16.2.3 build 27905, version=27905,

count=21, id=260, version=27412,

count=11, id=259, version=27412,

count=184, id=261, version=27412,

count=1, id=260, productName=VS2019 v16.3.2 build 28105, version=28105,

count=122, id=261, productName=VS2019 v16.3.2 build 28105, version=28105,

count=1, id=255, productName=VS2019 v16.3.2 build 28105, version=28105,

count=1, id=151,

count=1, id=258, productName=VS2019 v16.3.2 build 28105, version=28105,