2026-07-30_ad2dd37caf43c60acedaf19bd64c14f0_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_ad2dd37caf43c60acedaf19bd64c14f0_cobalt-strike_icedid_njrat_vidar
Size 3.6MB
Sample260730-hlblgssfre
SHA256 0e33a79170228efc889a94b3b03622808d70e4ff2ea39fc35fae6ba5d4e4724f
MD5 ad2dd37caf43c60acedaf19bd64c14f0
SHA1 9175bfd2f31aeb524980a693a9bcb5b964e767f6
SHA512 382c31ac6d12807c00f3fddef29d08dea1a45a546dd9c7ad8c92398ca531ac8ba265c8a8c51c614b1790e640fc1a092799caa3ff3aa5242b483d0f6c788e9099
SSDEEP 49152:SEPqhfUZq6hJ2GeB4FL1xYIIyTfXvIgkJYfz0Jmo/zZsTBOFOMfIJVh0M5lU:kNGDxK8fKVsT5hY
TLSH
T1F1065C52A3640599D2678078CD65CA66D7723C0D43F056EB72E4BAE63F33AD53A3A303
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

File Explorer

2026-07-30_ad2dd37caf43c60acedaf19bd64c14f0_cobalt-strike_icedid_njrat_vidar

.exe 3.6MB

2026-07-30_ad2dd37caf43c60acedaf19bd64c14f0_cobalt-strike_icedid_njrat_vidar

IMPHASH e9fe683b324d389ad2f1ea13ce3c472b
SHA256 0e33a79170228efc889a94b3b03622808d70e4ff2ea39fc35fae6ba5d4e4724f
MD5 ad2dd37caf43c60acedaf19bd64c14f0
SHA1 9175bfd2f31aeb524980a693a9bcb5b964e767f6
SHA512 382c31ac6d12807c00f3fddef29d08dea1a45a546dd9c7ad8c92398ca531ac8ba265c8a8c51c614b1790e640fc1a092799caa3ff3aa5242b483d0f6c788e9099
SSDEEP 49152:SEPqhfUZq6hJ2GeB4FL1xYIIyTfXvIgkJYfz0Jmo/zZsTBOFOMfIJVh0M5lU:kNGDxK8fKVsT5hY
TLSH
T1F1065C52A3640599D2678078CD65CA66D7723C0D43F056EB72E4BAE63F33AD53A3A303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing possible sandbox analysis VM usernames

Digest

63:be:71:63:ec:d9:15:e5:4f:8a:f5:70:d3:8c:6f:89:79:bb:9d:dc:25:e0:98:68:0a:42:26:89:c7:69:36:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=uvnc bvba,O=uvnc bvba,ST=Antwerpen,C=BE

Chains

Apr 16, 2025

CN=uvnc bvba,O=uvnc bvba,ST=Antwerpen,C=BE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=uvnc bvba,O=uvnc bvba,ST=Antwerpen,C=BE

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=uvnc bvba,O=uvnc bvba,ST=Antwerpen,C=BE

Serial Number

4c:03:67:0a:31:e6:2b:9f:ac:b9:d2:d3:70:39:bd:07

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 23, 2022 - Sep 22, 2025

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

1814848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\rudi\Desktop\git_ultravnc\vncviewer\x64\Release\vncviewer.pdb

comctl32

ImageList_ReplaceIcon ord345 CreateToolbarEx ord17 ImageList_Create ord6 InitCommonControlsEx

winmm

PlaySoundA timeKillEvent timeSetEvent timeGetTime

ws2_32

WSAGetLastError setsockopt freeaddrinfo htons inet_ntoa socket send WSAAddressToStringA WSAStartup getpeername getaddrinfo inet_pton shutdown select gethostbyname closesocket __WSAFDIsSet ioctlsocket recv WSAAsyncSelect listen bind accept WSACleanup inet_addr ntohs connect

kernel32

SetFilePointer SetEndOfFile lstrlenA MoveFileExA CreateFileA FileTimeToSystemTime FileTimeToLocalFileTime GetLogicalDriveStringsA SystemTimeToFileTime lstrcmpiA CreateDirectoryA GetFileTime FlushFileBuffers MulDiv GetStdHandle WriteConsoleA OutputDebugStringA AllocConsole ExpandEnvironmentStringsA GetComputerNameA SizeofResource FindResourceA LocalAlloc LockResource LoadResource GetSystemTimeAsFileTime FlsGetValue FlsAlloc GetModuleFileNameW GetCurrentDirectoryW SetCurrentDirectoryW SetEnvironmentVariableW SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FreeLibraryAndExitThread ExitThread SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle GetDriveTypeW CreateFileW GetFullPathNameW GetModuleHandleExW ExitProcess SetStdHandle GetTimeZoneInformation LoadLibraryExW TlsFree InitializeCriticalSectionAndSpinCount RtlUnwind SetLastError InterlockedFlushSList InterlockedPushEntrySList RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo CompareStringEx GetStringTypeW GetLocaleInfoEx LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx SetFileTime GetCurrentProcessId GetModuleHandleW GetStartupInfoW IsDebuggerPresent WriteFile TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext CreateSemaphoreA GetSystemTime TlsGetValue TlsAlloc GetCurrentThread DuplicateHandle GetCurrentThreadId SetThreadPriority ReleaseSemaphore TlsSetValue GetFileType lstrcatA GetProcessHeap lstrcpynA HeapAlloc ReleaseMutex CreateMutexA GetCurrentProcess HeapFree DosDateTimeToFileTime GetLocalTime SetFileAttributesA SetVolumeLabelA LocalFileTimeToFileTime GetVersion GetLocaleInfoA GetVolumeInformationA GetFullPathNameA QueryPerformanceCounter QueryPerformanceFrequency SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx CreateDirectoryW GetFileAttributesExW HeapReAlloc MoveFileA CompareFileTime ReadFile lstrcpyA DeleteFileA CopyFileA GetTempPathA FindClose SetErrorMode InitializeSListHead DeleteFileW SetFileAttributesW MoveFileExW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetConsoleCtrlHandler OutputDebugStringW RemoveDirectoryW WriteConsoleW HeapSize FindNextFileA FindFirstFileA WideCharToMultiByte GlobalFree GetDriveTypeA GlobalSize FlsSetValue MultiByteToWideChar GetPrivateProfileStringA GlobalUnlock GetPrivateProfileIntA GlobalLock WritePrivateProfileStringA GlobalAlloc GetTickCount CreateEventA FormatMessageA FreeLibrary DeleteCriticalSection LocalFree GetProcAddress Beep ResetEvent CreateThread CloseHandle GetVersionExA LoadLibraryA SetEvent GetFileAttributesA GetLastError Sleep ResumeThread WaitForSingleObject InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleFileNameA GetModuleHandleA IsProcessorFeaturePresent

user32

OemToCharA ToUnicode SetWindowRgn WindowFromDC MapWindowPoints LoadBitmapA IntersectRect GetMenuStringA ModifyMenuA DispatchMessageA GetMenuItemCount DestroyIcon DrawTextA GetWindow CharToOemA GetComboBoxInfo PeekMessageA GetWindowTextLengthA CreateDialogParamA IsDlgButtonChecked EnumDisplaySettingsA GetCaretBlinkTime SetCaretBlinkTime GetScrollInfo ScreenToClient GetTouchInputInfo CloseTouchInputHandle LoadKeyboardLayoutA EnableWindow MonitorFromPoint VkKeyScanW GetKeyboardState keybd_event ToAscii GetKeyState GetForegroundWindow PostThreadMessageA CallNextHookEx GetMessageA SendDlgItemMessageA GetTopWindow EnumDisplayDevicesA MonitorFromWindow GetSystemMetrics EnumDisplaySettingsExA GetMonitorInfoA SystemParametersInfoA ValidateRect LoadMenuA wvsprintfA TranslateMessage GetMenuItemID LoadStringA TrackPopupMenu GetSubMenu SetMenuDefaultItem RegisterClassExA OpenClipboard CloseClipboard IsClipboardFormatAvailable RegisterClipboardFormatA RedrawWindow SetWindowLongA SetCursorPos GetCursorPos GetClipboardOwner EmptyClipboard GetClipboardData SetClipboardData SetScrollInfo GetSystemMenu AdjustWindowRectEx GetMessageExtraInfo ShowScrollBar GetFocus DestroyWindow GetDC SetWindowPos SetClipboardViewer PostMessageA FillRect GetKeyboardLayoutNameA CreatePopupMenu ShowWindow IsWindow InvalidateRgn RegisterWindowMessageA SetTimer RegisterTouchWindow ChangeClipboardChain GetWindowLongA SendNotifyMessageA MessageBoxA MoveWindow UnregisterTouchWindow RegisterClassA DefWindowProcA DestroyMenu CreateWindowExA SetFocus ScrollWindowEx DrawMenuBar GetDlgItemInt AppendMenuA CheckMenuItem GetClientRect SetRect KillTimer PostQuitMessage GetSysColorBrush EnableMenuItem SetDlgItemInt UpdateWindow IsIconic ReleaseDC BeginPaint EndPaint GetDlgItemTextA GetWindowTextA SetWindowTextA TranslateAcceleratorA DestroyAcceleratorTable CreateAcceleratorTableA LoadImageA EndDialog DialogBoxParamA IsRectEmpty SetDlgItemTextA LoadIconA GetDesktopWindow SetForegroundWindow RemovePropA SetPropA GetWindowRect LoadCursorA GetCapture ClientToScreen CallWindowProcA GetPropA SendMessageA SetCapture SetCursor GetDlgItem GetWindowLongPtrA GetParent SetWindowLongPtrA PtInRect ReleaseCapture InvalidateRect GetWindowThreadProcessId SetWindowsHookExA

gdi32

DeleteObject GetObjectA GetDeviceCaps GetStockObject UpdateColors RealizePalette StretchBlt SetDIBColorTable CreateDIBSection CreateFontIndirectA CreateRectRgnIndirect Rectangle MoveToEx CreatePen LineTo SetTextColor SetBkMode CreatePolygonRgn CreateFontA SetROP2 CreateSolidBrush DeleteDC CreateRectRgn PatBlt CreateCompatibleDC SelectObject BitBlt CombineRgn SetStretchBltMode CreatePalette SetBrushOrgEx GetClipBox SelectPalette

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

advapi32

GetSecurityDescriptorLength CryptGenKey CryptGetHashParam CryptImportKey CryptSetKeyParam CryptDestroyHash CryptHashData GetSecurityDescriptorSacl AdjustTokenPrivileges GetSecurityDescriptorDacl GetSecurityDescriptorGroup LookupPrivilegeValueA GetSecurityDescriptorControl GetSecurityDescriptorOwner IsValidSid IsValidSecurityDescriptor OpenProcessToken GetKernelObjectSecurity SetKernelObjectSecurity IsValidAcl CryptCreateHash RegCloseKey RegQueryValueExA RegSetValueExA RegOpenKeyExA CryptDestroyKey CryptAcquireContextA CryptEncrypt CryptGenRandom CryptDecrypt CryptExportKey CryptReleaseContext

shell32

Shell_NotifyIconA SHFileOperationA SHGetFolderPathA SHBrowseForFolderA SHGetMalloc SHGetSpecialFolderPathA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

imm32

ImmAssociateContext

secur32

DecryptMessage FreeCredentialsHandle InitializeSecurityContextA DeleteSecurityContext AcquireCredentialsHandleA AcceptSecurityContext EncryptMessage QueryContextAttributesA ApplyControlToken FreeContextBuffer

crypt32

CertGetCertificateChain CertVerifyCertificateChainPolicy CertGetCertificateContextProperty CertFreeCertificateContext CertFreeCertificateChain

cryptui

CryptUIDlgViewCertificateA

shlwapi

PathFindFileNameA

gdiplus

GdipGetImageEncodersSize GdipFree GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipCloneImage GdipGetImageEncoders GdiplusShutdown GdiplusStartup GdipSaveImageToFile

version

VerQueryValueA

Name

.text

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

531KB

Virtual Size

531KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

354KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

417KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_ad2dd37caf43c60acedaf19bd64c14f0_cobalt-strike_icedid_njrat_vidar

comctl32

winmm

ws2_32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

imm32

secur32

crypt32

cryptui

shlwapi

gdiplus

version

generic