2026-07-20_7aea00b5f3221b086b98ea449c6302c6_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-20_7aea00b5f3221b086b98ea449c6302c6_cobalt-strike_icedid_njrat_vidar
Size 5.8MB
Sample260720-v2thfshx5p
SHA256 f8d71ed78c4096ef254ad97c6e9bae73ac0052e88c6f7f24fa279c5ff4fa4e5f
MD5 7aea00b5f3221b086b98ea449c6302c6
SHA1 f2e15ebf6fa8030a40314198b71b812a54d6fbb8
SHA512 5136533b92f2eab5348a85579453bd337f80056131e7b02129212d7aa7a3b981b82bb8b5ecc75853edf1638a748696cae9e54639ae516c73559d7ab92761a2b0
SSDEEP 98304:ucH1T6wImjM9wJ32+wxR/Xn2SORXv1l2/V0cETQ/I:uILImjM9wJ3sRfn2SORXv1+Z
TLSH
T14F567C1323D88284E0BBC07DC9578AA6D7713C05CB60D6FB21897A6AEF77DD50D3A621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_7aea00b5f3221b086b98ea449c6302c6_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-07-20_7aea00b5f3221b086b98ea449c6302c6_cobalt-strike_icedid_njrat_vidar

.exe 5.8MB

2026-07-20_7aea00b5f3221b086b98ea449c6302c6_cobalt-strike_icedid_njrat_vidar

IMPHASH bed7054d46bda472e00cdc682325faae
SHA256 f8d71ed78c4096ef254ad97c6e9bae73ac0052e88c6f7f24fa279c5ff4fa4e5f
MD5 7aea00b5f3221b086b98ea449c6302c6
SHA1 f2e15ebf6fa8030a40314198b71b812a54d6fbb8
SHA512 5136533b92f2eab5348a85579453bd337f80056131e7b02129212d7aa7a3b981b82bb8b5ecc75853edf1638a748696cae9e54639ae516c73559d7ab92761a2b0
SSDEEP 98304:ucH1T6wImjM9wJ32+wxR/Xn2SORXv1l2/V0cETQ/I:uILImjM9wJ3sRfn2SORXv1+Z
TLSH
T14F567C1323D88284E0BBC07DC9578AA6D7713C05CB60D6FB21897A6AEF77DD50D3A621
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\mbagd\Desktop\Sources\Components_Git\windriver\Build\StagingArea\src-WTabletServiceISD\WinDriver\Build\StagingArea\intermediate\Release\64\WTabletServiceISD.pdb

gdiplus

GdipCreatePath GdipAlloc GdipFree GdipDeletePath GdipAddPathEllipse GdipAddPathString GdipAddPathPieI GdipCreateMatrix GdipDeleteMatrix GdipRotateMatrix GdipCreateRegionPath GdiplusShutdown GdiplusStartup GdipCreateFontFamilyFromName GdipDrawImageRect GdipBitmapSetResolution GdipCreateBitmapFromHICON GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromScan0 GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipGetImagePixelFormat GdipGetImageRawFormat GdipGetImageFlags GdipDisposeImage GdipCloneImage GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipDeleteStringFormat GdipCreateStringFormat GdipGetFamily GdipDeleteFont GdipCreateFont GdipCreateFontFromLogfontW GdipCreateFontFromDC GdipIsStyleAvailable GdipGetFamilyName GdipGetGenericFontFamilySansSerif GdipCloneFontFamily GdipDeleteFontFamily GdipRestoreGraphics GdipSaveGraphics GdipResetClip GdipSetClipRegion GdipSetClipGraphics GdipDrawImageRectI GdipDrawImage GdipFillPath GdipGraphicsClear GdipDrawPath GdipGetWorldTransform GdipRotateWorldTransform GdipTranslateWorldTransform GdipResetWorldTransform GdipSetWorldTransform GdipSetSmoothingMode GdipDeleteGraphics GdipGetImageHeight GdipGetImageWidth GdipGetImageBounds GdipGetImageGraphicsContext GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipTransformRegion GdipCombineRegionPath GdipDeleteRegion

newdev

UpdateDriverForPlugAndPlayDevicesW

user32

IsWindowVisible PostThreadMessageW SetProcessDPIAware UnhookWinEvent SetWinEventHook EnumDisplayMonitors GetMonitorInfoW EnumDisplayDevicesW EnumDisplaySettingsExW FindWindowExW GetDesktopWindow MsgWaitForMultipleObjects keybd_event RegisterClassW UnregisterDeviceNotification VkKeyScanExW SendMessageTimeoutA PeekMessageW PeekMessageA LoadIconW LoadBitmapW SetClassLongPtrW SetWindowLongPtrW EnumWindows FillRect MapWindowPoints GetWindowRect IsIconic ToUnicodeEx SetWindowRgn EndPaint BeginPaint UpdateWindow DrawTextW GetSystemMetrics ReleaseCapture SetCapture GetCapture GetDlgItem SetWindowPos SetLayeredWindowAttributes IsWindow PostQuitMessage SendMessageW wsprintfW GetCursorPos SetDoubleClickTime QueryDisplayConfig SetDisplayConfig GetDisplayConfigBufferSizes CallNextHookEx UnhookWindowsHookEx GetClassNameW SystemParametersInfoA PostMessageW GetForegroundWindow MsgWaitForMultipleObjectsEx SetForegroundWindow GetClientRect WindowFromPoint MapVirtualKeyExW GetWindowLongPtrW SendInput GetWindowThreadProcessId GetMessageW TranslateMessage DispatchMessageW DefWindowProcW UnregisterClassW RegisterClassExW CreateWindowExW GetKeyboardState GetAsyncKeyState GetKeyState RegisterDeviceNotificationA GetKeyboardLayout mouse_event GetWindowTextW SetWindowsHookExW DestroyIcon LoadStringW SystemParametersInfoW LoadCursorW ReleaseDC GetDC KillTimer SetTimer MoveWindow UpdateLayeredWindow ShowWindow DestroyWindow

bluetoothapis

BluetoothGATTUnregisterEvent BluetoothGATTRegisterEvent BluetoothGATTGetServices BluetoothGATTGetCharacteristics BluetoothGATTGetDescriptors BluetoothGATTGetCharacteristicValue BluetoothGATTSetCharacteristicValue BluetoothGATTSetDescriptorValue

shlwapi

SHCreateStreamOnFileEx AssocQueryStringW PathFileExistsW

hid

HidP_GetCaps HidP_GetValueCaps HidP_GetSpecificValueCaps HidD_SetFeature HidD_FreePreparsedData HidD_GetFeature HidP_GetButtonCaps HidD_GetPreparsedData HidD_GetHidGuid HidD_GetAttributes

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification WTSQueryUserToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

setupapi

CM_Get_Parent CM_Get_DevNode_Status CM_Get_Device_ID_ExW CM_Get_Device_IDW SetupDiSetClassInstallParamsW SetupDiGetDeviceRegistryPropertyA SetupDiGetDevicePropertyW SetupDiOpenDevRegKey SetupDiChangeState SetupDiCallClassInstaller SetupDiGetClassDevsExW SetupDiGetClassDevsW SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailW SetupDiDeleteDeviceInterfaceData SetupDiOpenDeviceInterfaceW SetupDiEnumDeviceInterfaces CM_Locate_DevNodeW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiOpenDeviceInfoW SetupDiCreateDeviceInfoList SetupUninstallOEMInfW SetupCopyOEMInfW SetupGetInfFileListW CM_Enable_DevNode CM_Disable_DevNode CM_Reenumerate_DevNode_Ex CM_Locate_DevNode_ExW

winmm

PlaySoundW

imm32

ImmDisableIME

kernel32

GetStringTypeW FormatMessageA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryEnterCriticalSection EncodePointer LCMapStringEx CompareStringEx GetCPInfo QueryPerformanceCounter QueryPerformanceFrequency SetFileInformationByHandle FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW CreateEventExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetFileInformationByHandleEx CreateSymbolicLinkW GetLocaleInfoEx InitializeCriticalSectionAndSpinCount InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW GetFileInformationByHandle GetFileType SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetStdHandle GetTempPathW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapReAlloc ReadConsoleW SetCurrentDirectoryW SetStdHandle SetConsoleCtrlHandler GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW HeapSize WriteConsoleW K32GetModuleFileNameExW K32EnumProcessModules K32EnumProcesses Process32NextW Process32FirstW CreateToolhelp32Snapshot lstrlenW LocalAlloc GetModuleFileNameW GetSystemWow64DirectoryW IsWow64Process GetWindowsDirectoryW GetSystemDirectoryW GetProcessId ProcessIdToSessionId GetExitCodeThread TerminateThread CreateSemaphoreExW OpenSemaphoreW OpenEventW OpenMutexW ReleaseMutex ReleaseSemaphore DuplicateHandle GetFileSize SetEndOfFile WideCharToMultiByte CreateFileW ReadFile OutputDebugStringW CloseHandle GetLastError SetLastError SetNamedPipeHandleState PeekNamedPipe TransactNamedPipe WaitNamedPipeW GetNamedPipeInfo GetOverlappedResult WaitForSingleObject CreateEventW GetCurrentProcessId GetCurrentThreadId GetLocalTime FreeLibrary GetProcAddress LoadLibraryW DeleteFileW GetFullPathNameW SetFileAttributesW HeapAlloc HeapFree GetProcessHeap LocalFree FormatMessageW lstrcmpW Sleep SetHandleInformation CreatePipe TerminateProcess CreateProcessA Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WTSGetActiveConsoleSessionId RaiseException CreateThread MulDiv InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WriteFile CreateEventA OpenProcess CreateFileMappingW MapViewOfFile UnmapViewOfFile MultiByteToWideChar RtlUnwind FindResourceExW LoadResource GetUserDefaultUILanguage GetSystemDefaultLCID GetUserDefaultLCID FreeResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalFree ExpandEnvironmentStringsW GetCurrentDirectoryW FindClose FindFirstFileW FindNextFileW SetEvent WaitForMultipleObjects ResetEvent WaitForSingleObjectEx CreateDirectoryW GetExitCodeProcess CopyFileW ReadFileEx WaitForMultipleObjectsEx GetCurrentThread SetThreadPriority GetCommTimeouts PurgeComm SetCommTimeouts GetTickCount InitializeCriticalSectionEx DecodePointer ConnectNamedPipe CreateNamedPipeW CancelIo GetModuleHandleW CreateMutexW GetCurrentProcess SetProcessShutdownParameters SetPriorityClass GetCommandLineW VerSetConditionMask GetProductInfo GetModuleHandleA VerifyVersionInfoW

gdi32

SetWindowExtEx SetViewportExtEx GetObjectW SetTextColor CreateDCW CreateDIBitmap DeleteDC CreateCompatibleDC DeleteObject SelectObject CreateFontW CreateRoundRectRgn CreateSolidBrush FrameRgn GetTextExtentExPointW StretchBlt SetMapMode SetBkColor

comdlg32

GetOpenFileNameW

advapi32

StartServiceCtrlDispatcherW ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo RegDeleteTreeW RegEnumValueW RegDeleteValueW LookupAccountSidW GetTokenInformation GetSecurityDescriptorSacl EqualSid AllocateAndInitializeSid SetServiceStatus RegisterServiceCtrlHandlerExW SetTokenInformation DuplicateTokenEx OpenProcessToken CreateProcessAsUserW RegQueryValueExA RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW SetKernelObjectSecurity InitializeSid InitializeAcl GetSidSubAuthority GetSidLengthRequired GetSecurityDescriptorDacl GetLengthSid GetKernelObjectSecurity GetAclInformation GetAce AddAce AddAccessAllowedAce RegDeleteKeyValueW StartServiceW StartServiceA QueryServiceStatus OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle CreateProcessAsUserA ImpersonateLoggedOnUser RevertToSelf InitializeSecurityDescriptor SetSecurityDescriptorDacl RegCloseKey RegOpenCurrentUser RegNotifyChangeKeyValue RegOpenKeyW RegQueryValueExW RegSetValueExA RegSetValueExW RegCreateKeyExW ChangeServiceConfig2W

shell32

SHFileOperationW ShellExecuteW SHGetKnownFolderItem Shell_NotifyIconW Shell_NotifyIconA SHGetPropertyStoreForWindow SHGetFolderPathW ShellExecuteExW SHGetSpecialFolderPathW ExtractIconExW

ole32

CreateStreamOnHGlobal CoUninitialize CoTaskMemFree CoInitialize CoCreateInstance CLSIDFromString CoInitializeEx

oleaut32

SafeArrayCreateVector SafeArrayUnaccessData SafeArrayAccessData SafeArrayDestroy VariantInit VariantClear

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

654KB

Virtual Size

653KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

66KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

100KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

592KB

Virtual Size

596KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_7aea00b5f3221b086b98ea449c6302c6_cobalt-strike_icedid_njrat_vidar

gdiplus

newdev

user32

bluetoothapis

shlwapi

hid

wtsapi32

userenv

setupapi

winmm

imm32

kernel32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic