2026-08-04_9c17a1ff06f184d005a0e2b3c5c5f979_cobalt-strike_icedid_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_9c17a1ff06f184d005a0e2b3c5c5f979_cobalt-strike_icedid_njrat_stealc_vidar
Size 4.9MB
Sample260804-gv37eseb53
SHA256 b04c35ac48c664ee340890667d219e0da4ccfb973921e169968b89f95501e107
MD5 9c17a1ff06f184d005a0e2b3c5c5f979
SHA1 3712e0ce1d8ed7491b4fd7fd5fd67fc28a6e69e6
SHA512 325069a64598e6f2f66b94b5656064f32a1ce1197d3b3efc5bca3248312b1b54bbd093df9ed51e8e2316a451d4e7d2165c0fa3e8d4a7b6fc9a5f9adb3fcbd24c
SSDEEP 49152:FSuWPzShI8dlWAb12rOhBFTZ0IIrD+vbU0wIyMGKcEnoZAmb5+Pl6bJTIZ5jdgp:h5rFDIrDpIykofslgJTIZ5Bgp
TLSH
T12F362A0A23DC0194F1F7A27D89FB5A02D5B778550B71C6CF0660428E2FB3EE599BA361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_9c17a1ff06f184d005a0e2b3c5c5f979_cobalt-strike_icedid_njrat_stealc_vidar

File Explorer

2026-08-04_9c17a1ff06f184d005a0e2b3c5c5f979_cobalt-strike_icedid_njrat_stealc_vidar

.exe 4.9MB

2026-08-04_9c17a1ff06f184d005a0e2b3c5c5f979_cobalt-strike_icedid_njrat_stealc_vidar

IMPHASH f6347c6855c6acec20dd78ce87450f04
SHA256 b04c35ac48c664ee340890667d219e0da4ccfb973921e169968b89f95501e107
MD5 9c17a1ff06f184d005a0e2b3c5c5f979
SHA1 3712e0ce1d8ed7491b4fd7fd5fd67fc28a6e69e6
SHA512 325069a64598e6f2f66b94b5656064f32a1ce1197d3b3efc5bca3248312b1b54bbd093df9ed51e8e2316a451d4e7d2165c0fa3e8d4a7b6fc9a5f9adb3fcbd24c
SSDEEP 49152:FSuWPzShI8dlWAb12rOhBFTZ0IIrD+vbU0wIyMGKcEnoZAmb5+Pl6bJTIZ5jdgp:h5rFDIrDpIykofslgJTIZ5Bgp
TLSH
T12F362A0A23DC0194F1F7A27D89FB5A02D5B778550B71C6CF0660428E2FB3EE599BA361
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1310288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dvs\p4\build\sw\rel\gpu_drv\r610\r610_00\drivers\nvwmi\_out\wddm2_amd64_release\nvwmi64.pdb

kernel32

TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW GetCurrentThread HeapAlloc HeapFree GetStdHandle GetFileType GetStartupInfoW ExitProcess GetSystemTimeAsFileTime CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleCtrlHandler IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW MultiByteToWideChar GetProcessHeap WideCharToMultiByte GetFileSizeEx SetFilePointerEx SetStdHandle WriteFile GetConsoleCP GetConsoleMode FlushFileBuffers GetModuleFileNameW ReadFile ReadConsoleW OutputDebugStringW HeapSize HeapReAlloc FormatMessageW WriteConsoleW InitializeSListHead QueryPerformanceCounter InitializeCriticalSectionAndSpinCount FormatMessageA SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFileTime GetTempPathW AreFileApisANSI DeviceIoControl CreateDirectoryExW CopyFileW MoveFileExW CreateHardLinkW SwitchToThread GetTickCount ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW GetLocalTime FindFirstFileW LoadLibraryW WaitNamedPipeW CreateFileA DeleteFileA FileTimeToLocalFileTime LocalFileTimeToFileTime SetFileInformationByHandle SetFilePointer GetTempPathA GetTempFileNameA FileTimeToDosDateTime DosDateTimeToFileTime GetFileInformationByHandleEx QueryPerformanceFrequency CreateProcessA GetModuleFileNameA LocalAlloc SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA RtlUnwind EncodePointer SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader InitializeCriticalSectionEx RaiseException DecodePointer LocalFree GetTimeFormatW K32GetProcessImageFileNameW K32GetModuleBaseNameW K32EnumProcessModules K32EnumProcesses VerifyVersionInfoW GetProcAddress ProcessIdToSessionId AcquireSRWLockExclusive GetDateFormatW GetTimeZoneInformation FileTimeToSystemTime GetCurrentProcessId SystemTimeToTzSpecificLocalTime ReleaseSRWLockExclusive InitializeSRWLock VerSetConditionMask WTSGetActiveConsoleSessionId QueryFullProcessImageNameW GetModuleHandleW OpenProcess GetCurrentProcess SignalObjectAndWait CreateEventW ResetEvent DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetCommandLineW RegisterWaitForSingleObject Sleep OpenEventW CreateMutexW ReleaseMutex SetEvent GetSystemDirectoryW CreateProcessW WaitForSingleObject GetLastError CloseHandle GetCurrentThreadId CreateFileW GetFileAttributesW WaitForSingleObjectEx

user32

ChangeDisplaySettingsExA GetMessageW TranslateMessage DispatchMessageW SetThreadDesktop CloseDesktop GetThreadDesktop GetUserObjectInformationW UnregisterClassW SendMessageW EnumDisplayDevicesW OpenInputDesktop RegisterDeviceNotificationW UnregisterDeviceNotification PostMessageW DefWindowProcW RegisterClassW CreateWindowExW DestroyWindow LoadIconW OpenDesktopW LoadStringW LoadCursorW

gdi32

DeleteDC GetDeviceGammaRamp SetDeviceGammaRamp CreateDCA

advapi32

ImpersonateLoggedOnUser PerfDeleteInstance PerfCreateInstance PerfSetCounterSetInfo PerfStopProvider PerfStartProvider CreateProcessWithTokenW LookupAccountSidW GetTokenInformation StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceStatus OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegGetValueW RegSetKeyValueW RegSetValueExW RegOpenKeyExW SetTokenInformation DuplicateTokenEx OpenProcessToken CreateProcessAsUserW RevertToSelf RegDisablePredefinedCacheEx RegCloseKey RegCreateKeyExW DeregisterEventSource RegisterEventSourceW ReportEventW RegQueryValueExW PerfSetULongCounterValue

shell32

SHGetFolderPathA SHGetFolderPathW CommandLineToArgvW

ole32

CoUninitialize CoInitializeEx CoInitializeSecurity CoCreateInstance

oleaut32

GetErrorInfo SafeArrayCreateVector SafeArrayPutElement SafeArrayDestroy SafeArrayCreate SafeArrayUnaccessData SafeArrayAccessData SysStringByteLen VariantChangeType VariantCopy VariantClear VariantInit SysStringLen SysFreeString SysAllocString CreateErrorInfo SetErrorInfo

shlwapi

StrStrIW PathAddBackslashW PathFileExistsW PathFindExtensionW PathAppendA PathIsFileSpecW PathAddExtensionW PathAppendW PathFindExtensionA PathFindFileNameW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

cabinet

ord23 ord10 ord11 ord13 ord14 ord20 ord22

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

cfgmgr32

CM_Register_Notification CM_Unregister_Notification

Name

.text

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

54KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

221KB

Virtual Size

220KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

180KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_9c17a1ff06f184d005a0e2b3c5c5f979_cobalt-strike_icedid_njrat_stealc_vidar

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wtsapi32

version

cabinet

userenv

cfgmgr32

generic