2026-08-10_7e9900edf7e1503310151ee37ee4c65a_cobalt-strike_icedid_mespinoza_njrat_ryuk_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_7e9900edf7e1503310151ee37ee4c65a_cobalt-strike_icedid_mespinoza_njrat_ryuk_stealc_vidar
Size 1.7MB
Sample260810-166w8szelb
SHA256 0654d935a8428bc7a99a8630f8b0cfd2bf67f20bdb6a7a433222b380c88d71ac
MD5 7e9900edf7e1503310151ee37ee4c65a
SHA1 aaa8d9c003228b95e26d07a158d122275cae6b95
SHA512 c6aaddabfa65c9d3041a5bb662c131194d7ab065f5ff19a5810118daefeebec208212162c33995e5abed2381f7f1c7a58b7693678783cf83598b1d19513cedd0
SSDEEP 12288:aHszlADEF6pgor24ac4PMmEnyx4UThvPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/:VADEvrPocv8+AycCnrFlsZJbeWBpc8w
TLSH
T14185D05AF29C43F4E167E17888964506EBB17486132256DF43F09ABA1F67BF11E3E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_7e9900edf7e1503310151ee37ee4c65a_cobalt-strike_icedid_mespinoza_njrat_ryuk_stealc_vidar

File Explorer

2026-08-10_7e9900edf7e1503310151ee37ee4c65a_cobalt-strike_icedid_mespinoza_njrat_ryuk_stealc_vidar

.exe 1.7MB

2026-08-10_7e9900edf7e1503310151ee37ee4c65a_cobalt-strike_icedid_mespinoza_njrat_ryuk_stealc_vidar

IMPHASH a2959a71b0a4864038ed264e915810ec
SHA256 0654d935a8428bc7a99a8630f8b0cfd2bf67f20bdb6a7a433222b380c88d71ac
MD5 7e9900edf7e1503310151ee37ee4c65a
SHA1 aaa8d9c003228b95e26d07a158d122275cae6b95
SHA512 c6aaddabfa65c9d3041a5bb662c131194d7ab065f5ff19a5810118daefeebec208212162c33995e5abed2381f7f1c7a58b7693678783cf83598b1d19513cedd0
SSDEEP 12288:aHszlADEF6pgor24ac4PMmEnyx4UThvPh2Jv0bKbycVUnXVciFlnFzCSUgNMO4/:VADEvrPocv8+AycCnrFlsZJbeWBpc8w
TLSH
T14185D05AF29C43F4E167E17888964506EBB17486132256DF43F09ABA1F67BF11E3E320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

230592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

B:\b\discord_desktop\build_x64\x64_mt\DiscordHookHelper64.exe.pdb

kernel32

CloseHandle CompareStringEx CompareStringW CreateEventW CreateFileW CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetExitCodeThread GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32GetModuleInformation LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep TerminateProcess Thread32First Thread32Next TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

user32

CreateWindowExA DefWindowProcA DestroyWindow EnumThreadWindows GetWindowLongPtrW PostThreadMessageW RegisterClassA UnhookWindowsHookEx

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken

shell32

CommandLineToArgvW

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree

shlwapi

PathFindFileNameW

dbghelp

MiniDumpWriteDump

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertGetNameStringW CryptHashPublicKeyInfo CryptMsgClose CryptMsgGetParam CryptQueryObject

wintrust

WinVerifyTrust

Name

.text

Size

379KB

Virtual Size

379KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_7e9900edf7e1503310151ee37ee4c65a_cobalt-strike_icedid_mespinoza_njrat_ryuk_stealc_vidar

kernel32

user32

advapi32

shell32

ole32

shlwapi

dbghelp

crypt32

wintrust

generic