2026-08-02_86cab9c7530b9ad2c61735d5c09b9ab5_akira_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_86cab9c7530b9ad2c61735d5c09b9ab5_akira_cobalt-strike_icedid_njrat_vidar
Size 2.3MB
Sample260802-rew4aabb47
SHA256 1fe34ef62eead31a703d24002a633f2898610e73c1585f4a359e23e8df776ada
MD5 86cab9c7530b9ad2c61735d5c09b9ab5
SHA1 1c05f8d1269e28c65750aa392036be029e081cb3
SHA512 557560b9a55ef7e43559c383391c45716443185a725333b574f158c08e93765a457f022829c39e6164a849f969033d8772366fb41f72408dbbd8c22cff4c0ae5
SSDEEP 24576:lVFBFdrEAdZmzaVeyN67xms+S2eZcmDA3psqjnhMgeiCl7G0nehbGZpbD:lfiAzm6N2xPueUDmg27RnWGj
TLSH
T1EFB59D56739C41C9E27B917DCA9B9B0ADAB27406432197CF016443EE1F27AE84E3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_86cab9c7530b9ad2c61735d5c09b9ab5_akira_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-08-02_86cab9c7530b9ad2c61735d5c09b9ab5_akira_cobalt-strike_icedid_njrat_vidar

.exe 2.3MB

2026-08-02_86cab9c7530b9ad2c61735d5c09b9ab5_akira_cobalt-strike_icedid_njrat_vidar

IMPHASH dbe1cbc61121385ec905bed11a85d053
SHA256 1fe34ef62eead31a703d24002a633f2898610e73c1585f4a359e23e8df776ada
MD5 86cab9c7530b9ad2c61735d5c09b9ab5
SHA1 1c05f8d1269e28c65750aa392036be029e081cb3
SHA512 557560b9a55ef7e43559c383391c45716443185a725333b574f158c08e93765a457f022829c39e6164a849f969033d8772366fb41f72408dbbd8c22cff4c0ae5
SSDEEP 24576:lVFBFdrEAdZmzaVeyN67xms+S2eZcmDA3psqjnhMgeiCl7G0nehbGZpbD:lfiAzm6N2xPueUDmg27RnWGj
TLSH
T1EFB59D56739C41C9E27B917DCA9B9B0ADAB27406432197CF016443EE1F27AE84E3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28676

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\LID-REL6-BUIL\src\Release\bin\x64\Release\LNBITSSvc4.pdb

kernel32

WaitForMultipleObjects GetSystemDirectoryW FreeLibrary LoadLibraryW SetLastError DeviceIoControl HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize Sleep OpenMutexW WideCharToMultiByte LocalFree GetSystemPowerStatus GetTickCount64 GetModuleFileNameW CopyFileW DeleteFileW MoveFileExW RtlCaptureStackBackTrace SetEndOfFile SetStdHandle OpenEventW CreateEventW ResetEvent SetEvent CreateFileW K32GetModuleFileNameExW K32EnumProcesses Process32NextW Process32FirstW CreateToolhelp32Snapshot WTSGetActiveConsoleSessionId QueryFullProcessImageNameW LoadLibraryExW GetProcAddress ReadProcessMemory OpenProcess ProcessIdToSessionId CreateProcessW GetCurrentProcessId GetCurrentProcess WaitForSingleObject CloseHandle OutputDebugStringW OutputDebugStringA DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException GetProcessHeap DecodePointer SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx SetConsoleCtrlHandler GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetCommandLineW GetCommandLineA WriteFile ExitProcess WriteConsoleW GetFileType GetStdHandle ReadFile GetFileAttributesExW CreateDirectoryW GetModuleHandleExW ResumeThread ExitThread RtlUnwindEx __C_specific_handler RtlPcToFileHeader WaitForMultipleObjectsEx UnregisterWaitEx QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList ReleaseSemaphore RtlUnwind DuplicateHandle SetProcessAffinityMask VirtualFree VirtualProtect VirtualAlloc GetVersionExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes GetCurrentThread UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer MultiByteToWideChar IsDebuggerPresent EnterCriticalSection LeaveCriticalSection FormatMessageA GetStringTypeW WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo TryEnterCriticalSection EncodePointer QueryPerformanceCounter QueryPerformanceFrequency InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer

user32

UnregisterClassW

advapi32

RegQueryInfoKeyW RegEnumKeyExW StartServiceW QueryServiceStatusEx OpenServiceW OpenSCManagerW EnumDependentServicesW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W RegDeleteTreeW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegNotifyChangeKeyValue RegCreateKeyExW RegCloseKey LookupPrivilegeValueW SetTokenInformation GetTokenInformation DuplicateTokenEx AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW

shell32

SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoInitializeSecurity CoInitializeEx CoCreateInstance CoSetProxyBlanket StringFromGUID2 CoUninitialize

oleaut32

LPSAFEARRAY_UserUnmarshal CreateErrorInfo SetErrorInfo VariantChangeType GetErrorInfo SysAllocString BSTR_UserSize SysFreeString VariantClear SysStringByteLen SysAllocStringByteLen VariantInit BSTR_UserMarshal BSTR_UserUnmarshal BSTR_UserFree LPSAFEARRAY_UserSize LPSAFEARRAY_UserMarshal LPSAFEARRAY_UserFree SafeArrayAccessData VarBstrCmp SafeArrayUnaccessData VariantCopy

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken

rpcrt4

NdrServerCall2 RpcStringFreeW RpcStringBindingComposeW RpcBindingFromStringBindingW RpcBindingFree NdrClientCall2

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInfo SetupDiGetClassDevsW SetupDiCallClassInstaller SetupDiGetClassDescriptionW SetupDiRemoveDevice SetupDiGetDeviceRegistryPropertyW SetupDiSetClassInstallParamsW CM_Get_DevNode_Status SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification PowerSettingRegisterNotification PowerGetActiveScheme

dbghelp

MakeSureDirectoryPathExists

winmm

timeKillEvent timeSetEvent

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

326KB

Virtual Size

325KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

21KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

437B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_86cab9c7530b9ad2c61735d5c09b9ab5_akira_cobalt-strike_icedid_njrat_vidar

kernel32

user32

advapi32

shell32

ole32

oleaut32

userenv

wtsapi32

rpcrt4

setupapi

api-ms-win-power-setting-l1-1-0

dbghelp

winmm

generic