2026-07-19_fc0eda02bbe01f7352650b50ed91944f_cobalt-strike_icedid_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-19_fc0eda02bbe01f7352650b50ed91944f_cobalt-strike_icedid_njrat_stealc_vidar
Size 1.6MB
Sample260720-amyteacv4s
SHA256 a1ac2367f297b82f8bbeebac377fa2b418c7e6ca25bc2dd79a0fe20bcb254a6d
MD5 fc0eda02bbe01f7352650b50ed91944f
SHA1 2e0f82349b8cf133de6a2d3f0dab63447afa38d9
SHA512 e32a7e086f916df4f7ca6f025871527f5eab4b1bfd88ead091f318efbcf0f3ae1a8eed6dab5314c492535ea2d97eb363a2d4101a445485d07ced174c59e601bc
SSDEEP 24576:R4PX2WCDHGv3zYUrjLtut61kRjf4pOFB1rpD5h0lSQ:GPGJ7GPckjLtut6mwOFB115h0
TLSH
T19E85E15A736405F5D427927DCA438A06E7B278051761CBCB02A4E3BE2F37AD15E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-19_fc0eda02bbe01f7352650b50ed91944f_cobalt-strike_icedid_njrat_stealc_vidar

File Explorer

2026-07-19_fc0eda02bbe01f7352650b50ed91944f_cobalt-strike_icedid_njrat_stealc_vidar

.exe 1.6MB

2026-07-19_fc0eda02bbe01f7352650b50ed91944f_cobalt-strike_icedid_njrat_stealc_vidar

IMPHASH dcf909001dc4ca6ff24c090bb96a29e9
SHA256 a1ac2367f297b82f8bbeebac377fa2b418c7e6ca25bc2dd79a0fe20bcb254a6d
MD5 fc0eda02bbe01f7352650b50ed91944f
SHA1 2e0f82349b8cf133de6a2d3f0dab63447afa38d9
SHA512 e32a7e086f916df4f7ca6f025871527f5eab4b1bfd88ead091f318efbcf0f3ae1a8eed6dab5314c492535ea2d97eb363a2d4101a445485d07ced174c59e601bc
SSDEEP 24576:R4PX2WCDHGv3zYUrjLtut61kRjf4pOFB1rpD5h0lSQ:GPGJ7GPckjLtut6mwOFB115h0
TLSH
T19E85E15A736405F5D427927DCA438A06E7B278051761CBCB02A4E3BE2F37AD15E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

116608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qb\workspace\21461\source\gfx-driver\dump64\miniport\IntelCpLSPCONSvc\Release\IntelCpHDCPSvc.pdb

kernel32

SizeofResource FindResourceW FreeLibrary GetCurrentThread GetCurrentProcess SleepEx LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapFree LocalFree lstrcmpiW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage MultiByteToWideChar HeapReAlloc HeapAlloc GetCommandLineW ReleaseMutex CloseHandle WriteFile ReadFile SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP FindNextFileW FindClose SetFilePointerEx GetConsoleMode GetCurrentThreadId OutputDebugStringA CreateThread CreateSemaphoreExW ReleaseSemaphore SetEvent WriteConsoleW LoadLibraryW QueryPerformanceCounter GetProcAddress GetCurrentProcessId DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException DecodePointer Sleep CreateEventW LCMapStringW WaitForSingleObject WaitForMultipleObjects CreateFileW DeviceIoControl CreateMutexW LoadResource LoadLibraryExW GetModuleHandleW FindFirstFileExW QueryPerformanceFrequency GetModuleFileNameW TryEnterCriticalSection SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount WideCharToMultiByte WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait EncodePointer GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue RtlUnwindEx RtlPcToFileHeader ExitProcess GetModuleHandleExW GetStdHandle GetFileType

advapi32

CloseServiceHandle ControlService CreateServiceW DeleteService OpenServiceW RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA QueryServiceConfigW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW NotifyServiceStatusChangeW EventRegister EventWrite EventUnregister ConvertStringSecurityDescriptorToSecurityDescriptorW ChangeServiceConfigW OpenSCManagerW RegQueryInfoKeyW RegOpenKeyExW RegOpenKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey SetSecurityDescriptorOwner SetSecurityDescriptorGroup MakeAbsoluteSD IsValidSid InitializeSecurityDescriptor GetTokenInformation GetSecurityDescriptorLength GetLengthSid OpenProcessToken OpenThreadToken CopySid

user32

LoadStringW DispatchMessageW MessageBoxW EnumDisplayDevicesW GetMessageW TranslateMessage CharUpperW PostThreadMessageW CharNextW

oleaut32

RegisterTypeLi VariantInit LoadRegTypeLi SafeArrayGetVartype SafeArrayCopy SafeArrayUnlock SafeArrayLock SafeArrayGetLBound SafeArrayGetUBound SafeArrayRedim SafeArrayDestroy SafeArrayCreate SysAllocString SysStringLen VarUI4FromStr SysFreeString LoadTypeLi VariantClear UnRegisterTypeLi

setupapi

CM_Get_Device_Interface_ListW CM_Get_Device_Interface_List_SizeW

ole32

CoInitializeEx CoUninitialize CoInitializeSecurity CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CoReleaseServerProcess CoAddRefServerProcess CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoSetProxyBlanket CoCreateInstance

api-ms-win-devices-config-l1-1-1

CM_Unregister_Notification CM_Register_Notification CM_MapCrToWin32Err

Name

.text

Size

315KB

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

128KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-19_fc0eda02bbe01f7352650b50ed91944f_cobalt-strike_icedid_njrat_stealc_vidar

kernel32

advapi32

user32

oleaut32

setupapi

ole32

api-ms-win-devices-config-l1-1-1

generic