2026-08-05_4a7172e5673ad5cb006d00b0de00c390_cobalt-strike_conti_hijackloader_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-05_4a7172e5673ad5cb006d00b0de00c390_cobalt-strike_conti_hijackloader_icedid_njrat_vidar
Size 915KB
Sample260805-gslvcsbl3x
SHA256 6671812154eb361af799ac70b277875c9fb3cbdf0ec0dbdff97c33acfc91c8e8
MD5 4a7172e5673ad5cb006d00b0de00c390
SHA1 2675b934ae8f6036d9a91cbe3e2f3c0f9faa8768
SHA512 6858f1a0fcbb88068dadc7fbb7b69741d43c637a11323a440e021e5e0c5ba4d5def2f77503fb4ee501abde6a0e5bc6eb1a5e34b9f5704e0694de925e482a50bc
SSDEEP 12288:l9blAXlIM8XNjMpdI0XNCpJ9tPWXq23loIQ8dBiWp1cPb:l9blAb8XNYdIJ9tOXqMpQ8Li+cPb
TLSH
T199158D5677A401EEC83BD27EC6474622FAB2B44617215BDF03A486697F237E15B3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_4a7172e5673ad5cb006d00b0de00c390_cobalt-strike_conti_hijackloader_icedid_njrat_vidar

File Explorer

2026-08-05_4a7172e5673ad5cb006d00b0de00c390_cobalt-strike_conti_hijackloader_icedid_njrat_vidar

.exe 915KB

2026-08-05_4a7172e5673ad5cb006d00b0de00c390_cobalt-strike_conti_hijackloader_icedid_njrat_vidar

IMPHASH 6027bdf152756731874e4030ca7769a7
SHA256 6671812154eb361af799ac70b277875c9fb3cbdf0ec0dbdff97c33acfc91c8e8
MD5 4a7172e5673ad5cb006d00b0de00c390
SHA1 2675b934ae8f6036d9a91cbe3e2f3c0f9faa8768
SHA512 6858f1a0fcbb88068dadc7fbb7b69741d43c637a11323a440e021e5e0c5ba4d5def2f77503fb4ee501abde6a0e5bc6eb1a5e34b9f5704e0694de925e482a50bc
SSDEEP 12288:l9blAXlIM8XNjMpdI0XNCpJ9tPWXq23loIQ8dBiWp1cPb:l9blAb8XNYdIJ9tOXqMpQ8Li+cPb
TLSH
T199158D5677A401EEC83BD27EC6474622FAB2B44617215BDF03A486697F237E15B3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

307836

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\constructicon\builds\gfx\three\22.20\drivers\2d\dal\eeu\build\client\wNow64a\B_rel\atieclxx.pdb

user32

EnumDisplaySettingsA CloseDesktop RegisterHotKey SystemParametersInfoA SetSysColors OpenInputDesktop SetThreadDesktop GetThreadDesktop GetAsyncKeyState ChangeDisplaySettingsExA SendInput GetSysColor RedrawWindow PostThreadMessageA UnregisterDeviceNotification RegisterDeviceNotificationA SystemParametersInfoW DisplayConfigSetDeviceInfo RegisterClassExA LoadIconA LoadStringA RegisterRawInputDevices GetRawInputData GetMonitorInfoW MonitorFromWindow FindWindowExW GetWindowLongPtrA GetClientRect GetWindowTextW UnhookWinEvent SetWinEventHook GetWindowThreadProcessId IsWindowVisible MessageBoxW DisplayConfigGetDeviceInfo EnumDisplayDevicesA EnumWindows GetPropA wsprintfW MessageBoxA RegisterWindowMessageA ChangeWindowMessageFilter QueryDisplayConfig SetDisplayConfig GetDisplayConfigBufferSizes GetClassNameA FindWindowA GetForegroundWindow UpdateWindow KillTimer SetTimer ShowWindow DestroyWindow CreateWindowExA RegisterClassA PostQuitMessage DefWindowProcA PostMessageA UnregisterSuspendResumeNotification RegisterSuspendResumeNotification UnregisterPowerSettingNotification RegisterPowerSettingNotification SendMessageA UnregisterHotKey DispatchMessageA GetMessageA

gdi32

D3DKMTPollDisplayChildren D3DKMTEnumAdapters D3DKMTQueryAdapterInfo DeleteDC CreateDCA SetDeviceGammaRamp

advapi32

DuplicateTokenEx SetEntriesInAclW RegNotifyChangeKeyValue AllocateAndInitializeSid RegCloseKey RegDeleteValueA RegGetValueW RegSetValueExW RegOpenCurrentUser SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryInfoKeyA RegEnumValueA RegEnumKeyExA RegDeleteKeyA RegOpenKeyExA CreateProcessAsUserW ConvertStringSecurityDescriptorToSecurityDescriptorA CreateProcessAsUserA OpenProcessToken RegDeleteTreeA RevertToSelf ImpersonateLoggedOnUser RegSetValueExA RegQueryValueExA RegCreateKeyExA RegGetValueA FreeSid

userenv

LoadUserProfileA DestroyEnvironmentBlock CreateEnvironmentBlock UnloadUserProfile

wtsapi32

WTSEnumerateSessionsA WTSQuerySessionInformationA WTSRegisterSessionNotification WTSQueryUserToken WTSEnumerateProcessesA WTSFreeMemory

powrprof

PowerRegisterSuspendResumeNotification PowerGetActiveScheme PowerSetActiveScheme PowerWritePossibleValue PowerWritePossibleFriendlyName PowerReadSettingAttributes PowerWriteACDefaultIndex PowerWriteDCDefaultIndex PowerWriteSettingAttributes PowerRemovePowerSetting PowerCreateSetting PowerCreatePossibleSetting PowerEnumerate PowerWriteACValueIndex PowerWriteDCValueIndex PowerSettingAccessCheck PowerReadACValueIndex PowerReadDCValueIndex PowerWriteFriendlyName

setupapi

CM_Reenumerate_DevNode CM_Get_Parent SetupDiSetClassInstallParamsA CM_Get_Device_IDA CM_Get_Child_Ex SetupDiClassGuidsFromNameA SetupDiGetClassDevsExA CM_Get_DevNode_Status_Ex CM_Get_Device_ID_ExA SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiGetClassDevsA SetupDiOpenDeviceInfoA SetupDiGetHwProfileList SetupDiGetDeviceInstanceIdA SetupGetInfDriverStoreLocationA SetupUninstallOEMInfA SetupDiBuildDriverInfoList SetupDiEnumDriverInfoA SetupDiGetDriverInfoDetailA SetupDiDestroyDriverInfoList SetupDiSetDeviceRegistryPropertyA SetupDiGetDeviceInstallParamsA SetupDiSetDeviceInstallParamsA CM_Get_Device_ID_Size CM_Locate_DevNodeA SetupDiCallClassInstaller SetupDiDestroyDeviceInfoList CM_Get_DevNode_Status

dwmapi

DwmIsCompositionEnabled

ole32

CoCreateInstance CoInitialize CoCreateGuid CoInitializeEx PropVariantClear CoUninitialize CoTaskMemFree

difxapi

DriverPackageInstallA DriverPackageUninstallA DriverPackageGetPathA DriverPackagePreinstallA

propsys

InitPropVariantFromDoubleVector

shlwapi

StrStrIA PathFindFileNameW PathStripPathW

newdev

DiInstallDriverA DiInstallDevice

kernel32

IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID DeviceIoControl QueryPerformanceFrequency RtlVirtualUnwind GetCurrentProcessId GetCurrentProcess GetCurrentThreadId WinExec TerminateThread OpenMutexA CreateMutexA ReleaseMutex SetEndOfFile RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead CompareStringW GetTimeFormatW GetPackageFamilyName GetSystemTimeAsFileTime GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCurrentThread HeapFree HeapReAlloc HeapSize ReadConsoleW CreateFileW SetFilePointerEx GetFileSizeEx SetConsoleCtrlHandler GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW WaitForMultipleObjects OpenEventA CreateEventA ResetEvent SetEvent GetTickCount VerifyVersionInfoW RemoveDirectoryA VerSetConditionMask GetLocalTime GetApplicationUserModelId LoadLibraryW GetModuleHandleA GetTimeZoneInformation FindNextFileA DeleteFileA CompareFileTime GetWindowsDirectoryA GetCommandLineW FileTimeToSystemTime lstrcmpA LocalAlloc FileTimeToLocalFileTime SetThreadPriority CreateThread QueryPerformanceCounter K32GetModuleBaseNameA K32EnumProcessModules QueryFullProcessImageNameA GetEnvironmentVariableA ReadFile FindFirstFileA FindClose K32GetProcessImageFileNameA K32EnumProcesses GetSystemDefaultLangID FindResourceExA LockResource LoadResource FreeResource GetSystemDirectoryA SetLastError GetFileTime CreateFileA CreateDirectoryA ExpandEnvironmentStringsA GetProcAddress CopyFileA LoadLibraryA FreeLibrary GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW OutputDebugStringW GetConsoleMode GetConsoleCP HeapAlloc GetFileType WideCharToMultiByte MultiByteToWideChar WriteConsoleW GetTempPathW SetFileAttributesA GetFileAttributesA Process32Next Process32First CreateToolhelp32Snapshot FlushFileBuffers EnumSystemLocalesW QueryFullProcessImageNameW GetCommandLineA GetLastError Sleep CreateProcessA GetModuleFileNameA MoveFileExA GetSystemPowerStatus CloseHandle MapViewOfFile UnmapViewOfFile AssignProcessToJobObject CreateFileMappingA OpenFileMappingA WaitForSingleObject GetExitCodeProcess OpenProcess IsWow64Process OutputDebugStringA SetInformationJobObject CreateJobObjectA WTSGetActiveConsoleSessionId LocalFree TerminateProcess lstrlenW GetDateFormatW

shell32

CommandLineToArgvW SHGetKnownFolderPath Shell_NotifyIconA

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

crypt32

CryptQueryObject CryptDecodeObjectEx CryptDecodeObject CryptMsgClose CryptMsgGetParam CertCloseStore

dbgeng

DebugCreate

generic

count=160, id=261, version=26213,

count=7, id=259, productName=VS2017 v15.6.6 build 26131, version=26131,

count=38, id=261, productName=VS2017 v15.6.6 build 26131, version=26131,

count=19, id=260, productName=VS2017 v15.6.6 build 26131, version=26131,

count=8, id=259, version=26213,

count=1, id=262, version=26213,

count=14, id=260, version=26213,

count=2, id=263, version=26213,

count=37, id=257, version=26213,

count=351, id=1, productName=Unmarked objects,

count=21, id=261, version=31107,

count=44, id=261, productName=VS2017 v15.7.1 build 26428, version=26428,

count=1, id=259, productName=VS2017 v15.7.1 build 26428, version=26428,

count=1, id=256, productName=VS2017 v15.7.1 build 26428, version=26428,

count=1, id=255, productName=VS2017 v15.7.1 build 26428, version=26428,

count=1, id=258, productName=VS2017 v15.7.1 build 26428, version=26428,