2026-08-11_450bb04e429e567a59023e2d098b4462_cobalt-strike_hijackloader_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_450bb04e429e567a59023e2d098b4462_cobalt-strike_hijackloader_icedid_njrat_vidar
Size 955KB
Sample260811-dv2rtacb99
SHA256 33015e2b75031d679a03d4468a7c63d312dfdcffcd66e34fd67e434168873703
MD5 450bb04e429e567a59023e2d098b4462
SHA1 a919ede332042b12e5d8353dd7a1e96a5b573afb
SHA512 27c20ffc7f1cdf12c6d6af6736194345127b572983554edefe0aec54423988c2549e00afda4a2cfb812616ec56888a2068f815844d3457a7f1644776f7496e38
SSDEEP 12288:g8D/wjiIqVBiL+3rqfVPnykNVkj24pK7ARFydxq3TpkM8ai:g8MqVwL7VPnyWVkpeKIoqM8ai
TLSH
T16D258D5A77A001EDC83BD27DCA475622FAB2B08A07215BDF03A487596F237F55A3E314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_450bb04e429e567a59023e2d098b4462_cobalt-strike_hijackloader_icedid_njrat_vidar

File Explorer

2026-08-11_450bb04e429e567a59023e2d098b4462_cobalt-strike_hijackloader_icedid_njrat_vidar

.exe 955KB

2026-08-11_450bb04e429e567a59023e2d098b4462_cobalt-strike_hijackloader_icedid_njrat_vidar

IMPHASH 7e19041abd9830a4d97aabdea42483bc
SHA256 33015e2b75031d679a03d4468a7c63d312dfdcffcd66e34fd67e434168873703
MD5 450bb04e429e567a59023e2d098b4462
SHA1 a919ede332042b12e5d8353dd7a1e96a5b573afb
SHA512 27c20ffc7f1cdf12c6d6af6736194345127b572983554edefe0aec54423988c2549e00afda4a2cfb812616ec56888a2068f815844d3457a7f1644776f7496e38
SSDEEP 12288:g8D/wjiIqVBiL+3rqfVPnykNVkj24pK7ARFydxq3TpkM8ai:g8MqVwL7VPnyWVkpeKIoqM8ai
TLSH
T16D258D5A77A001EDC83BD27DCA475622FAB2B08A07215BDF03A487596F237F55A3E314
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

330620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\constructicon\builds\gfx\three\23.19\drivers\2d\dal\eeu\build\client\wNow64a\B_rel\atieclxx.pdb

user32

RegisterDeviceNotificationA DispatchMessageA UnregisterHotKey SendMessageA RegisterPowerSettingNotification UnregisterPowerSettingNotification RegisterSuspendResumeNotification UnregisterSuspendResumeNotification PostMessageA DefWindowProcA PostQuitMessage RegisterClassA CreateWindowExA DestroyWindow ShowWindow SetTimer KillTimer UpdateWindow GetForegroundWindow FindWindowA GetClassNameA GetDisplayConfigBufferSizes SetDisplayConfig QueryDisplayConfig DisplayConfigGetDeviceInfo ChangeWindowMessageFilter RegisterWindowMessageA MessageBoxA wsprintfW GetPropA EnumWindows EnumDisplayDevicesA MessageBoxW IsWindowVisible GetWindowThreadProcessId SetWinEventHook UnhookWinEvent EnumDisplaySettingsA ChangeDisplaySettingsExA GetThreadDesktop CloseDesktop SetThreadDesktop OpenInputDesktop SendInput GetAsyncKeyState RegisterHotKey SystemParametersInfoA SetSysColors GetSysColor RedrawWindow PostThreadMessageA UnregisterDeviceNotification GetMessageA SystemParametersInfoW DisplayConfigSetDeviceInfo RegisterClassExA LoadIconA LoadStringA RegisterRawInputDevices GetRawInputData GetMonitorInfoW MonitorFromWindow FindWindowExW GetWindowLongPtrA GetClientRect GetWindowTextW GetWindowPlacement

gdi32

D3DKMTPollDisplayChildren D3DKMTEnumAdapters D3DKMTQueryAdapterInfo DeleteDC CreateDCA SetDeviceGammaRamp

advapi32

RegEnumKeyExA RegDeleteValueA RegOpenKeyExA RegGetValueA RegCreateKeyExA RegQueryValueExA RegSetValueExA ImpersonateLoggedOnUser RevertToSelf RegDeleteTreeA CloseServiceHandle DeleteService OpenSCManagerA OpenServiceA OpenProcessToken AllocateAndInitializeSid FreeSid SetEntriesInAclW RegNotifyChangeKeyValue CreateProcessAsUserA RegGetValueW RegSetValueExW RegOpenCurrentUser SetSecurityDescriptorDacl InitializeSecurityDescriptor EventWriteTransfer EventUnregister EventRegister RegQueryInfoKeyA RegEnumValueA ConvertStringSecurityDescriptorToSecurityDescriptorA RegDeleteKeyA DuplicateTokenEx CreateProcessAsUserW RegCloseKey

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock LoadUserProfileA UnloadUserProfile

wtsapi32

WTSQuerySessionInformationA WTSRegisterSessionNotification WTSQueryUserToken WTSEnumerateProcessesA WTSEnumerateSessionsA WTSFreeMemory

powrprof

PowerGetActiveScheme PowerSetActiveScheme PowerCreateSetting PowerCreatePossibleSetting PowerRegisterSuspendResumeNotification PowerWriteSettingAttributes PowerReadSettingAttributes PowerWriteFriendlyName PowerWritePossibleValue PowerWritePossibleFriendlyName PowerWriteACDefaultIndex PowerWriteDCDefaultIndex PowerEnumerate PowerWriteACValueIndex PowerWriteDCValueIndex PowerSettingAccessCheck PowerReadACValueIndex PowerReadDCValueIndex PowerRegisterForEffectivePowerModeNotifications PowerUnregisterFromEffectivePowerModeNotifications PowerRemovePowerSetting

setupapi

SetupDiBuildDriverInfoList SetupUninstallOEMInfA SetupGetInfDriverStoreLocationA SetupDiGetDeviceInstanceIdA SetupDiSetDeviceRegistryPropertyA SetupDiGetHwProfileList SetupDiRestartDevices SetupDiCallClassInstaller SetupDiOpenDeviceInfoA SetupDiGetDeviceRegistryPropertyA CM_Get_Parent CM_Get_DevNode_Status CM_Get_Device_IDA CM_Get_Child_Ex SetupDiEnumDriverInfoA SetupDiGetClassDevsExA CM_Get_DevNode_Status_Ex CM_Get_Device_ID_ExA SetupDiEnumDeviceInfo SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiGetDriverInfoDetailA SetupDiGetDeviceInstallParamsA SetupDiSetDeviceInstallParamsA CM_Get_Device_ID_Size CMP_WaitNoPendingInstallEvents SetupDiEnumDeviceInterfaces SetupDiGetDeviceInterfaceDetailA SetupDiGetDeviceInterfacePropertyW CM_Locate_DevNodeA SetupDiClassGuidsFromNameA SetupDiDestroyDriverInfoList SetupDiSetClassInstallParamsA CM_Reenumerate_DevNode

dwmapi

DwmIsCompositionEnabled

ole32

PropVariantClear CoCreateInstance CoCreateGuid CoInitialize CoInitializeEx CoTaskMemFree CoUninitialize

difxapi

DriverPackageInstallA DriverPackageUninstallA DriverPackageGetPathA DriverPackagePreinstallA

propsys

InitPropVariantFromDoubleVector

shlwapi

PathStripPathW PathFindFileNameW StrStrIA

newdev

DiInstallDevice DiInstallDriverA

kernel32

GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter RtlUnwindEx IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList EncodePointer UnhandledExceptionFilter EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCurrentThread HeapFree HeapAlloc GetFileType WideCharToMultiByte MultiByteToWideChar GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode OutputDebugStringW GetSystemTimeAsFileTime FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetCurrentThreadId WinExec TerminateThread OpenMutexA CreateMutexA ReleaseMutex WaitForMultipleObjects OpenEventA CreateEventA ResetEvent SetEvent GetTickCount VerifyVersionInfoW RemoveDirectoryA VerSetConditionMask GetLocalTime CreateFileW GetApplicationUserModelId LoadLibraryW GetModuleHandleA GetTimeZoneInformation FindNextFileA DeleteFileA CompareFileTime GetWindowsDirectoryA GetCurrentProcess GetCommandLineW FileTimeToSystemTime lstrcmpA LocalAlloc FileTimeToLocalFileTime SetThreadPriority CreateThread QueryPerformanceCounter K32GetModuleBaseNameA K32EnumProcessModules QueryFullProcessImageNameA GetEnvironmentVariableA ReadFile FindFirstFileA FindClose K32GetProcessImageFileNameA K32EnumProcesses GetSystemDefaultLangID FindResourceExA LockResource LoadResource FreeResource GetSystemDirectoryA SetLastError GetFileTime CreateFileA CreateDirectoryA ExpandEnvironmentStringsA CopyFileA GetTempPathW SetFileAttributesA GetProcessHeap SetConsoleCtrlHandler GetFileSizeEx GetFileAttributesA Process32Next Process32First CreateToolhelp32Snapshot QueryFullProcessImageNameW lstrlenW DeviceIoControl SetFilePointerEx ReadConsoleW HeapSize SetEndOfFile WriteConsoleW TerminateProcess LocalFree WTSGetActiveConsoleSessionId CreateJobObjectA LoadLibraryA GetProcAddress QueryPerformanceFrequency GetPackageFamilyName GetCurrentProcessId GetCommandLineA GetLastError Sleep CreateProcessA GetModuleFileNameA MoveFileExA GetSystemPowerStatus CloseHandle MapViewOfFile UnmapViewOfFile AssignProcessToJobObject CreateFileMappingA OpenFileMappingA WaitForSingleObject GetExitCodeProcess OpenProcess IsWow64Process OutputDebugStringA SetInformationJobObject FreeLibrary

shell32

ShellExecuteA Shell_NotifyIconA CommandLineToArgvW SHGetKnownFolderPath

wintrust

WinVerifyTrust

imagehlp

ImageGetCertificateData ImageEnumerateCertificates

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

crypt32

CryptDecodeObjectEx CertGetNameStringA CertEnumCertificatesInStore CertOpenStore CryptQueryObject CertCloseStore CryptMsgGetParam CryptMsgClose CryptDecodeObject

dbgeng

DebugCreate

generic

count=161, id=261, version=26213,

count=7, id=259, productName=VS2017 v15.6.6 build 26131, version=26131,

count=38, id=261, productName=VS2017 v15.6.6 build 26131, version=26131,

count=19, id=260, productName=VS2017 v15.6.6 build 26131, version=26131,

count=8, id=259, version=26213,

count=1, id=262, version=26213,

count=14, id=260, version=26213,

count=2, id=263, version=26213,

count=41, id=257, version=26213,

count=373, id=1, productName=Unmarked objects,

count=21, id=261, version=31933,

count=48, id=261, productName=VS2017 v15.7.1 build 26428, version=26428,

count=1, id=259, productName=VS2017 v15.7.1 build 26428, version=26428,

count=1, id=256, productName=VS2017 v15.7.1 build 26428, version=26428,

count=1, id=255, productName=VS2017 v15.7.1 build 26428, version=26428,

count=1, id=258, productName=VS2017 v15.7.1 build 26428, version=26428,