2026-08-03_1807a15588734db1f2b62de8688d486a_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_1807a15588734db1f2b62de8688d486a_cobalt-strike_icedid_njrat_vidar
Size 480KB
Sample260803-de939abc48
SHA256 d65af3afef45f35918db615ac8d13ea19f18eb8a684226754b673321459de406
MD5 1807a15588734db1f2b62de8688d486a
SHA1 6de81ced3a7929cf8ad7008c2c551513233d90d1
SHA512 1a0692d4b45e5a210c7810f0c887000836c2ef24ecc6fb360710ae4cbf8faded0db3e52dec4c330352a621ed2fcae94ff23a8496ba343a1307a983dd00001d94
SSDEEP 12288:+lxFkdqBBydxtri9gvdRWKPmawYItwatI/cKgZnCv6C7ffMcfuo55wgynczYEh:KZnCvBLfMho5By2D
TLSH
T19EA47B19FB6504F4D977D17CC8628A86E6B2B81A0B71D7DF1394421A2F336909E3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_1807a15588734db1f2b62de8688d486a_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-08-03_1807a15588734db1f2b62de8688d486a_cobalt-strike_icedid_njrat_vidar

.exe 480KB

2026-08-03_1807a15588734db1f2b62de8688d486a_cobalt-strike_icedid_njrat_vidar

IMPHASH 4d4c7538658d9c5190d62e7ce34041f2
SHA256 d65af3afef45f35918db615ac8d13ea19f18eb8a684226754b673321459de406
MD5 1807a15588734db1f2b62de8688d486a
SHA1 6de81ced3a7929cf8ad7008c2c551513233d90d1
SHA512 1a0692d4b45e5a210c7810f0c887000836c2ef24ecc6fb360710ae4cbf8faded0db3e52dec4c330352a621ed2fcae94ff23a8496ba343a1307a983dd00001d94
SSDEEP 12288:+lxFkdqBBydxtri9gvdRWKPmawYItwatI/cKgZnCv6C7ffMcfuo55wgynczYEh:KZnCvBLfMho5By2D
TLSH
T19EA47B19FB6504F4D977D17CC8628A86E6B2B81A0B71D7DF1394421A2F336909E3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

450560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shlwapi

SHDeleteValueW SHDeleteKeyW

setupapi

SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiRemoveDevice SetupDiEnumDeviceInfo

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP HeapAlloc GetProcessHeap HeapFree FindFirstFileW FindNextFileW FindClose SetEnvironmentVariableW DeleteFileW GetLastError CreateFileW WriteFile CloseHandle DeleteFileA GetACP SetStdHandle ReadConsoleW HeapSize SetEndOfFile GetTempPathW RtlVirtualUnwind WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry WriteConsoleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent SetEvent ResetEvent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException FreeLibrary LoadLibraryExW HeapReAlloc ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx FindFirstFileExW IsValidCodePage

advapi32

GetUserNameW

iphlpapi

GetAdaptersInfo

Name

.text

Size

218KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd003

Size

116KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_1807a15588734db1f2b62de8688d486a_cobalt-strike_icedid_njrat_vidar

shlwapi

setupapi

kernel32

advapi32

iphlpapi

generic