2026-07-31_1bba57a9562b6656ef3c3970cf5a6447_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_1bba57a9562b6656ef3c3970cf5a6447_cobalt-strike_icedid_njrat_vidar
Size 3.6MB
Sample260731-e172fsap7x
SHA256 1d0610f350284aca39ce418082d1daf4dc12e9f74a2d8a10f85913e525397193
MD5 1bba57a9562b6656ef3c3970cf5a6447
SHA1 16daed6d7eabb6c2ca083a131fda27575520e3b1
SHA512 3d3e21e7fd3c346467088a4f5dfecabc35b142e1bc010fafc45c1ea7378caf96e3dbb88c4c8d8031b86c2681510dbb9b155b043daffc7054192cf3fdc3c010b2
SSDEEP 49152:MPxROIMNYm+x72JWfR83BFJjG/CAcvcaI9ivy7i20f1j8yHq9SASScpfB5X:OxROIYeyWfRiBfzIVSfJW9SVN55
TLSH
T1AF06AF5B72AD01E8D077D17DCA465A06F7B278054732A7CB12F486AA1F27BE14E7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_1bba57a9562b6656ef3c3970cf5a6447_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-07-31_1bba57a9562b6656ef3c3970cf5a6447_cobalt-strike_icedid_njrat_vidar

.exe 3.6MB

2026-07-31_1bba57a9562b6656ef3c3970cf5a6447_cobalt-strike_icedid_njrat_vidar

IMPHASH a8ac88dc7ae327720be4445394838726
SHA256 1d0610f350284aca39ce418082d1daf4dc12e9f74a2d8a10f85913e525397193
MD5 1bba57a9562b6656ef3c3970cf5a6447
SHA1 16daed6d7eabb6c2ca083a131fda27575520e3b1
SHA512 3d3e21e7fd3c346467088a4f5dfecabc35b142e1bc010fafc45c1ea7378caf96e3dbb88c4c8d8031b86c2681510dbb9b155b043daffc7054192cf3fdc3c010b2
SSDEEP 49152:MPxROIMNYm+x72JWfR83BFJjG/CAcvcaI9ivy7i20f1j8yHq9SASScpfB5X:OxROIYeyWfRiBfzIVSfJW9SVN55
TLSH
T1AF06AF5B72AD01E8D077D17DCA465A06F7B278054732A7CB12F486AA1F27BE14E7E320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1397456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qba1\workspace\17493\SSE_Storage_Common\build\iaStorAfs\package\x64\Release\iaStorAfsService.pdb

kernel32

FindNextFileNameW LocalFree GetCommandLineA TlsSetValue CreateEventW ResetEvent Sleep WaitForMultipleObjects InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetModuleHandleW GetProcAddress CreateFileW DeviceIoControl GetCommandLineW MultiByteToWideChar InitializeCriticalSectionAndSpinCount FindFirstFileExW OutputDebugStringW QueryPerformanceCounter ReadFile WriteFile DeleteFileW GetModuleFileNameW GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentThread DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize GetTickCount64 CreateTimerQueue CreateTimerQueueTimer DeleteTimerQueueEx GetSystemDirectoryW FindFirstFileNameW GetFinalPathNameByHandleW OpenFileById FindFirstFileW FindNextFileW GetCurrentProcess SetPriorityClass DeleteTimerQueueTimer GetSystemPowerStatus HeapFree TryEnterCriticalSection CreateDirectoryW GetFileAttributesW SetFileAttributesW InitializeCriticalSection ExitProcess TlsAlloc TlsFree HeapReAlloc MoveFileW HeapAlloc HeapDestroy GetLastError CloseHandle DecodePointer WaitForSingleObject SetEvent SetEnvironmentVariableW HeapCreate GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile TlsGetValue CompareFileTime ExpandEnvironmentStringsW GetSystemTime SystemTimeToFileTime SuspendThread ResumeThread FindClose lstrlenW GetOverlappedResult CancelIoEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError TerminateProcess IsProcessorFeaturePresent GetSystemInfo VirtualAlloc VirtualProtect VirtualQuery CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW GetCurrentThreadId HeapQueryInformation FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetFileType GetStartupInfoW RaiseException GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode WideCharToMultiByte SetConsoleCtrlHandler IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW SetStdHandle ReadConsoleW WriteConsoleW RtlUnwindEx RtlPcToFileHeader RtlUnwind EncodePointer InterlockedFlushSList ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetCurrentProcessId FormatMessageA LCMapStringEx GetLocaleInfoEx CompareStringEx SetFilePointer FileTimeToLocalFileTime GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW UnmapViewOfFile FileTimeToSystemTime HeapValidate GetTempPathA FormatMessageW LeaveCriticalSection AreFileApisANSI EnterCriticalSection GetTickCount MapViewOfFile CreateFileMappingW GetFileSize LockFileEx UnlockFile HeapCompact LoadLibraryW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTimeZoneInformation

advapi32

DeregisterEventSource ReportEventW ConvertStringSecurityDescriptorToSecurityDescriptorW TraceMessage GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW RegisterEventSourceW QueryServiceStatusEx OpenServiceW ChangeServiceConfigW QueryServiceConfigW StartServiceW EnumDependentServicesW OpenThreadToken CopySid EqualSid GetLengthSid GetSidLengthRequired GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation InitializeSid IsValidSid ControlService DeleteService RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey ChangeServiceConfig2W OpenSCManagerW AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl CloseServiceHandle SetEntriesInAclW CreateServiceW RegDeleteTreeW RegCreateKeyExW

shlwapi

PathIsDirectoryW PathFindExtensionW PathFindFileNameW PathIsRelativeW PathFileExistsW PathRemoveFileSpecW

rpcrt4

RpcServerUseProtseqEpW RpcImpersonateClient RpcRevertToSelf RpcMgmtStopServerListening RpcMgmtWaitServerListen RpcEpRegisterW NdrAsyncServerCall NdrServerCallAll Ndr64AsyncServerCallAll NdrServerCall2 RpcEpUnregister RpcServerTestCancel RpcAsyncCompleteCall RpcBindingVectorFree RpcServerInqBindings RpcServerUnregisterIf RpcServerListen RpcAsyncAbortCall RpcServerRegisterIf3

userenv

UnloadUserProfile

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoRegisterClassObject CoRevokeClassObject CoSetProxyBlanket

oleaut32

VariantInit VariantClear SysAllocString SetErrorInfo VariantChangeType GetErrorInfo CreateErrorInfo SysFreeString

fltlib

FilterReplyMessage FilterGetMessage FilterSendMessage FilterConnectCommunicationPort

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification PowerSettingUnregisterNotification

user32

LoadStringW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

498KB

Virtual Size

497KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

44KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_1bba57a9562b6656ef3c3970cf5a6447_cobalt-strike_icedid_njrat_vidar

kernel32

advapi32

shlwapi

rpcrt4

userenv

api-ms-win-security-base-l1-2-2

ole32

oleaut32

fltlib

api-ms-win-power-setting-l1-1-0

user32

api-ms-win-core-winrt-error-l1-1-0

generic