2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar
Size 933KB
Sample260727-ndvbhs1bjc
SHA256 d488dfa4db535a5b0b6d80471bf7bcf1ca58772192dbcc1dcc364883e2f33a9c
MD5 8c7bc14b78e7468e68a8aeab8035162f
SHA1 18a351aa8fdf597988bfe41efc8e615019e2850f
SHA512 730193a95acf2a8d2ac00849eba6aaf9c8989d954f79ebe0a42f1d1778d1e9c0d4f6ef956a40e6183a13e3c591cb7504778cc41780851b1a0d146b3ca305663f
SSDEEP 12288:wU2SixQyGk/bZ7vnmPxzTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:wU0Cy/mdDnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T10D15BF1173E405A8F9B7A6788DF68122EA337C855B78C69F0354416A2FB3F91CD35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar

.exe 933KB

2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar

IMPHASH 40cb3c31cc8813e43a245f6cd2739eff
SHA256 d488dfa4db535a5b0b6d80471bf7bcf1ca58772192dbcc1dcc364883e2f33a9c
MD5 8c7bc14b78e7468e68a8aeab8035162f
SHA1 18a351aa8fdf597988bfe41efc8e615019e2850f
SHA512 730193a95acf2a8d2ac00849eba6aaf9c8989d954f79ebe0a42f1d1778d1e9c0d4f6ef956a40e6183a13e3c591cb7504778cc41780851b1a0d146b3ca305663f
SSDEEP 12288:wU2SixQyGk/bZ7vnmPxzTGyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMW6:wU0Cy/mdDnQ/tbw/2Mkjy6Fr7g0o6
TLSH
T10D15BF1173E405A8F9B7A6788DF68122EA337C855B78C69F0354416A2FB3F91CD35B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

109436

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Z:\b\cnss_proc\bt\App\Bin\x64\Release\AdminService.pdb

bluetoothapis

BluetoothSetLocalServiceInfo BluetoothFindRadioClose BluetoothGetRadioInfo BluetoothFindFirstRadio

ole32

StringFromGUID2 CLSIDFromString

shlwapi

StrCmpW PathRemoveFileSpecW

cfgmgr32

CM_Reenumerate_DevNode_Ex CM_Get_Device_ID_ExW CM_Disconnect_Machine CM_Locate_DevNode_ExW CM_Connect_MachineW CM_Get_DevNode_Status CM_Get_Next_Res_Des_Ex CM_Get_Res_Des_Data_Ex CM_Get_First_Log_Conf_Ex CM_Get_Res_Des_Data_Size_Ex CM_Free_Res_Des_Handle CM_Free_Log_Conf_Handle CM_Get_DevNode_Status_Ex

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiCreateDeviceInfoW SetupDiGetClassDescriptionExW SetupDiBuildClassInfoListExW SetupDiClassGuidsFromNameExW SetupDiSetDeviceRegistryPropertyW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsExW SetupDiSetClassInstallParamsW SetupDiGetDeviceInfoListDetailW SetupDiCallClassInstaller SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW SetupDiGetDeviceInstallParamsW SetupDiOpenClassRegKeyExW SetupDiGetDriverInstallParamsW SetupFindFirstLineW SetupDiSetDeviceInstallParamsW SetupOpenInfFileW SetupGetStringFieldW SetupDiBuildDriverInfoList SetupDiGetDriverInfoDetailW SetupDiEnumDriverInfoW SetupDiDestroyDriverInfoList SetupCloseInfFile SetupDiOpenDeviceInfoW SetupDiGetDeviceRegistryPropertyW SetupDiCreateDeviceInfoListExW SetupDiClassNameFromGuidExW SetupCopyOEMInfW

powrprof

CallNtPowerInformation

kernel32

GetCommandLineW GetCommandLineA GetStdHandle GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer SetLastError RtlPcToFileHeader FindFirstFileW GetCurrentProcess DeviceIoControl GetModuleFileNameW FindClose WaitForSingleObject CreateFileW ResumeThread CreateEventW GetExitCodeThread Sleep GetLastError OutputDebugStringW SetEvent TerminateThread GlobalFree CloseHandle LoadLibraryW CreateThread ResetEvent GetLocalTime GetProcAddress GlobalLock ExitProcess GetModuleHandleW FreeLibrary GetTickCount GlobalUnlock GetFileType GetFullPathNameW FindNextFileW lstrlenW GetFileAttributesW GetWindowsDirectoryW SizeofResource HeapFree GetSystemPowerStatus InitializeCriticalSectionEx GetVersionExW HeapSize GetPrivateProfileStringW LockResource HeapReAlloc RaiseException FindResourceExW LoadResource FindResourceW HeapAlloc HeapDestroy DeleteCriticalSection GetProcessHeap GetPrivateProfileSectionW GetNativeSystemInfo FormatMessageW LocalFree FileTimeToSystemTime GetDateFormatW WideCharToMultiByte WriteFile GetCurrentThreadId GetCurrentProcessId RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry SetStdHandle GetStringTypeW GetFileSizeEx SetFilePointerEx CompareStringW LCMapStringW GetExitCodeProcess CreateProcessW GetFileAttributesExW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetConsoleCP GetConsoleMode WriteConsoleW SetEnvironmentVariableW GlobalAlloc RtlCaptureContext WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection

user32

DispatchMessageW GetMessageW CharNextW TranslateMessage PostThreadMessageW UnregisterDeviceNotification RegisterDeviceNotificationW LoadStringW CharPrevW

advapi32

OpenSCManagerW RegEnumValueW OpenServiceW RegDeleteValueW StartServiceCtrlDispatcherW RegGetValueW RegQueryValueExA RegOpenKeyExA InitiateSystemShutdownExW QueryServiceStatus RegDeleteKeyExW LookupPrivilegeValueW RegisterServiceCtrlHandlerExW AdjustTokenPrivileges CreateServiceW RegCloseKey RegQueryInfoKeyW CloseServiceHandle RegQueryValueExW SetServiceStatus ChangeServiceConfig2W RegCreateKeyExW DeleteService ControlService RegEnumKeyExW RegDeleteTreeW RegSetValueExW OpenProcessToken StartServiceW RegOpenKeyExW

shell32

SHGetSpecialFolderPathW ShellExecuteW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

Name

.text

Size

200KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_8c7bc14b78e7468e68a8aeab8035162f_cobalt-strike_icedid_njrat_vidar

bluetoothapis

ole32

shlwapi

cfgmgr32

setupapi

powrprof

kernel32

user32

advapi32

shell32

version

generic