2026-08-08_859cb565fded20002f104e8ac74e6eee_cobalt-strike_elex_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_859cb565fded20002f104e8ac74e6eee_cobalt-strike_elex_icedid_njrat_vidar
Size 696KB
Sample260808-drpyvabd73
SHA256 637c099d7775ee40e9de1f98cca7cfb06f6f054a705dbdac65b0851dde094b74
MD5 859cb565fded20002f104e8ac74e6eee
SHA1 9b93c6a4a7aa30ffaa6d20740dfa2ca229aed1b9
SHA512 1454109687c6a3aa6fbe7b046f1c0b3528a42eb884f06dd466993f8a87a039d71055d9f511e0c4184a7d1990e49ee7a4c9ec32d38a328aaac32f19d69de8b3d1
SSDEEP 12288:fVIIAdEmcZAO8VgBHa/55CGvOXDBAZzP/w24lhns:2uAO8SB6/5lvaANw243ns
TLSH
T1AEE46C01BBD44AF5FDB381399D7A8619A936BD510B10D6EB63607B2D8D337C0AE39321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_859cb565fded20002f104e8ac74e6eee_cobalt-strike_elex_icedid_njrat_vidar

File Explorer

2026-08-08_859cb565fded20002f104e8ac74e6eee_cobalt-strike_elex_icedid_njrat_vidar

.exe 696KB

2026-08-08_859cb565fded20002f104e8ac74e6eee_cobalt-strike_elex_icedid_njrat_vidar

IMPHASH 78106e9579b543450c245f5800b1d21c
SHA256 637c099d7775ee40e9de1f98cca7cfb06f6f054a705dbdac65b0851dde094b74
MD5 859cb565fded20002f104e8ac74e6eee
SHA1 9b93c6a4a7aa30ffaa6d20740dfa2ca229aed1b9
SHA512 1454109687c6a3aa6fbe7b046f1c0b3528a42eb884f06dd466993f8a87a039d71055d9f511e0c4184a7d1990e49ee7a4c9ec32d38a328aaac32f19d69de8b3d1
SSDEEP 12288:fVIIAdEmcZAO8VgBHa/55CGvOXDBAZzP/w24lhns:2uAO8SB6/5lvaANw243ns
TLSH
T1AEE46C01BBD44AF5FDB381399D7A8619A936BD510B10D6EB63607B2D8D337C0AE39321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

218288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\DCB\CBT_Main\BuildResults\bin\Release\AcroBroker.pdb

kernel32

SizeofResource FindResourceW LoadLibraryW lstrcmpiW MultiByteToWideChar GetUserDefaultLCID CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSize ReadFile RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointer WriteFile LocalAlloc LoadResource CopyFileW WideCharToMultiByte InitializeCriticalSectionAndSpinCount OutputDebugStringW InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx ResetEvent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime SwitchToThread GetFullPathNameW LoadLibraryExW GetModuleHandleW GetModuleHandleA GetModuleFileNameW FreeLibrary GetCurrentThreadId CreateThread Sleep CreateEventW WaitForSingleObject SetEvent DeleteCriticalSection InitializeCriticalSectionEx SetLastError RaiseException DecodePointer OutputDebugStringA GetLongPathNameW LocalFree GetCurrentProcessId GetCurrentProcess GetLastError CloseHandle GetTempPathW CreateDirectoryW GetProcAddress InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TlsAlloc GetDriveTypeW CreateSemaphoreA TlsFree TlsSetValue TlsGetValue

user32

DispatchMessageW PostThreadMessageW CharNextW MessageBoxW CreateWindowStationW SetProcessWindowStation GetProcessWindowStation GetUserObjectInformationW TranslateMessage GetMessageW CreateDesktopW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

CryptGenRandom CryptReleaseContext CryptAcquireContextW RegSetValueExA RegCreateKeyExA RegSetValueExW RegQueryValueExA RegQueryInfoKeyW RegOpenKeyExA RegOpenKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo GetSecurityInfo SetEntriesInAclW CreateWellKnownSid CopySid RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

ShellExecuteExW SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHGetSpecialFolderPathW SHGetKnownFolderPath

ole32

CoRevokeClassObject CoRegisterClassObject CoReleaseServerProcess CoCreateInstance CoTaskMemAlloc CoUninitialize CoTaskMemRealloc CoInitialize CoResumeClassObjects CoAddRefServerProcess CoTaskMemFree

oleaut32

VarUI4FromStr SysAllocString SysFreeString SysStringLen SysAllocStringByteLen SafeArrayDestroy SafeArrayAccessData SafeArrayUnaccessData SafeArrayCreateVector

sqlite

sqlite3_exec sqlite3_changes sqlite3_open_v2 sqlite3_result_value sqlite3_result_error sqlite3_value_type sqlite3_value_int sqlite3_errmsg sqlite3_create_function sqlite3_errcode sqlite3_prepare_v2 sqlite3_bind_blob sqlite3_busy_handler sqlite3_close sqlite3_get_autocommit sqlite3_reset sqlite3_finalize sqlite3_column_type sqlite3_column_bytes sqlite3_column_text sqlite3_column_int64 sqlite3_column_int sqlite3_free sqlite3_column_blob sqlite3_step sqlite3_bind_parameter_count sqlite3_bind_text sqlite3_bind_null sqlite3_bind_int64 sqlite3_bind_int sqlite3_bind_double sqlite3_last_insert_rowid sqlite3_column_double

msvcp140

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

shlwapi

AssocQueryStringW PathRemoveBackslashW PathCanonicalizeW

vcruntime140

memset memmove memcpy __CxxFrameHandler3 __std_exception_destroy _CxxThrowException wcsstr __std_terminate memchr memcmp _except_handler4_common __std_exception_copy wcsrchr _purecall

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo _errno _initterm _invalid_parameter_noinfo_noreturn _initialize_wide_environment _get_wide_winmain_command_line _set_app_type _seh_filter_exe terminate _cexit _controlfp_s _crt_atexit _register_onexit_function _initialize_onexit_table _configure_wide_argv _register_thread_local_exe_atexit_callback _c_exit exit _set_invalid_parameter_handler _exit _initterm_e

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf fclose __stdio_common_vsprintf __stdio_common_vsnwprintf_s _wfopen __stdio_common_vswprintf _set_fmode __p__commode

api-ms-win-crt-string-l1-1-0

strcat_s wcstok_s strlen wcsnlen wcscat_s tolower _wcsicmp wcsncpy_s wcscpy_s iswalpha wcslen strncpy_s _strdup strtok_s _wcsdup _wcsnicmp wcsncmp

api-ms-win-crt-heap-l1-1-0

realloc malloc free _callnewh _set_new_mode _recalloc

api-ms-win-crt-filesystem-l1-1-0

_wrename _wsplitpath_s _wsplitpath

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

generic

count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=10, id=259, productName=VS2017 v15.6.6 build 26131, version=26131,

count=12, id=260, productName=VS2017 v15.6.6 build 26131, version=26131,

count=4, id=257, productName=VS2017 v15.6.6 build 26131, version=26131,

count=2, id=257, productName=VS2017 v15.7.5 build 26433, version=26433,

count=3, id=260, version=25711,

count=1, id=262, version=25711,

count=17, id=257, version=25711,

count=289, id=1, productName=Unmarked objects,

count=40, id=261, productName=VS2017 v15.6.6 build 26131, version=26131,

count=17, id=125, productName=VS2005 build 50727, version=50727,

count=98, id=109, productName=VS2005 build 50727, version=50727,

count=27, id=261, productName=VS2017 v15.7.5 build 26433, version=26433,

count=1, id=260, productName=VS2017 v15.7.5 build 26433, version=26433,

count=1, id=255, productName=VS2017 v15.7.5 build 26433, version=26433,

count=1, id=151,

count=1, id=258, productName=VS2017 v15.7.5 build 26433, version=26433,