2026-01-16_ef7966a8426c85dd6a86393607963bf6_cobalt-strike_icedid_njrat_vidar[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2026-01-16_ef7966a8426c85dd6a86393607963bf6_cobalt-strike_icedid_njrat_vidar.exe
Size 207KB
Sample260820-tfqc8stycy
SHA256 0d3f99e343ee2be2d7490bc97a7858df2a19c01da02b0801ccc13161a42f2f72
MD5 ddd83434beab7dfec4a6e5bb6ad4d24c
SHA1 058385e9e994e1d6f822567fbbb777dbee51ccf5
SHA512 d02e5bc8e7fbf6afd9d420a70dca4bcba40d6e69b40d873ab36163cab93e8c275c9d2f2ac8ffc77e45cb40db677f877b168cf0431894f20909a0fca70b06a96e
SSDEEP 96:88yXdNubef37sWPh9JyxjlvfP/rbHVncTNuU0FoUPrU/E3or49+GVqZDA/4wsvfi:QXryefA4h9J2FoUzU/cor4ASsAgwf
TLSH
T10024D6015D3E0CBBDEB212B4A1B2009F99E865300423ED372FC4149E9E8F1D4662AFAD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-01-16_ef7966a8426c85dd6a86393607963bf6_cobalt-strike_icedid_njrat_vidar.exe

File Explorer

2026-01-16_ef7966a8426c85dd6a86393607963bf6_cobalt-strike_icedid_njrat_vidar.exe

.exe 207KB

2026-01-16_ef7966a8426c85dd6a86393607963bf6_cobalt-strike_icedid_njrat_vidar.exe

IMPHASH 4d963b5bc847d61744be6bdeaecb2ed6
SHA256 0d3f99e343ee2be2d7490bc97a7858df2a19c01da02b0801ccc13161a42f2f72
MD5 ddd83434beab7dfec4a6e5bb6ad4d24c
SHA1 058385e9e994e1d6f822567fbbb777dbee51ccf5
SHA512 d02e5bc8e7fbf6afd9d420a70dca4bcba40d6e69b40d873ab36163cab93e8c275c9d2f2ac8ffc77e45cb40db677f877b168cf0431894f20909a0fca70b06a96e
SSDEEP 96:88yXdNubef37sWPh9JyxjlvfP/rbHVncTNuU0FoUPrU/E3or49+GVqZDA/4wsvfi:QXryefA4h9J2FoUzU/cor4ASsAgwf
TLSH
T10024D6015D3E0CBBDEB212B4A1B2009F99E865300423ED372FC4149E9E8F1D4662AFAD
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15612

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetExitCodeProcess CreateProcessW GetModuleFileNameW LoadResource LockResource WaitForSingleObject FindResourceW LoadLibraryW WriteConsoleW CreateFileW GetLastError CloseHandle SizeofResource GetFileAttributesW GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW LCMapStringW VirtualAlloc

user32

wsprintfW MessageBoxW

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

shell32

ShellExecuteExW

shlwapi

PathCombineW PathRemoveFileSpecW PathCanonicalizeW

gdi32

CreateFontW DeleteObject GetDeviceCaps SelectObject SetBkMode SetTextColor TextOutW BitBlt CreateCompatibleDC CreatePen

comdlg32

GetOpenFileNameW GetSaveFileNameW PrintDlgW ChooseColorW

ole32

CoInitializeEx CoUninitialize CoCreateInstance CoTaskMemFree

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

comctl32

InitCommonControlsEx ImageList_Create ImageList_Destroy

winmm

PlaySoundW timeGetTime

uxtheme

OpenThemeData CloseThemeData DrawThemeBackground

Name

.text

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

53KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.debug

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-01-16_ef7966a8426c85dd6a86393607963bf6_cobalt-strike_icedid_njrat_vidar.exe

kernel32

user32

advapi32

shell32

shlwapi

gdi32

comdlg32

ole32

oleaut32

comctl32

winmm

uxtheme

generic