2026-08-20_9a561d3f7b73c809c443dfff6f5d82c0_cobalt-strike_icedid_njrat_vidar

General

Target
2026-08-20_9a561d3f7b73c809c443dfff6f5d82c0_cobalt-strike_icedid_njrat_vidar
Size 252KB
Sample260821-c7cssahc48
SHA256 952e959903d40721f8fc93fa54ac81e88491ff18d9678b2bc1a04ef6b9c5282a
MD5 9a561d3f7b73c809c443dfff6f5d82c0
SHA1 271e54b65ef680ddc147b0cdb380d5957e7f1304
SHA512 733b0f68974a78b613a2a86722b1e735973a953ac3ec0480f07141947fc5b8315b071489d8a81e3ee64fd5978c3842f21052dfb74753ebde6cb7f2e4366a4b3c
SSDEEP 3072:SUgTnK7hqZCSGwsAI9K/AUKikpM9oU0vj0P8oS+AArPy1EX6KRtiXetQvvFy8c+f:jg06/fKn33oSpArWEVXiXet0vFi4MSGI
TLSH
T1EB444A1A77E84CF9E927C17D89428606E77278050735DADF03A0427B6F237E1AE39B61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_9a561d3f7b73c809c443dfff6f5d82c0_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-08-20_9a561d3f7b73c809c443dfff6f5d82c0_cobalt-strike_icedid_njrat_vidar

.exe 252KB

2026-08-20_9a561d3f7b73c809c443dfff6f5d82c0_cobalt-strike_icedid_njrat_vidar

IMPHASH 55af0e3f3caf77df1f3eb49f79375621
SHA256 952e959903d40721f8fc93fa54ac81e88491ff18d9678b2bc1a04ef6b9c5282a
MD5 9a561d3f7b73c809c443dfff6f5d82c0
SHA1 271e54b65ef680ddc147b0cdb380d5957e7f1304
SHA512 733b0f68974a78b613a2a86722b1e735973a953ac3ec0480f07141947fc5b8315b071489d8a81e3ee64fd5978c3842f21052dfb74753ebde6cb7f2e4366a4b3c
SSDEEP 3072:SUgTnK7hqZCSGwsAI9K/AUKikpM9oU0vj0P8oS+AArPy1EX6KRtiXetQvvFy8c+f:jg06/fKn33oSpArWEVXiXet0vFi4MSGI
TLSH
T1EB444A1A77E84CF9E927C17D89428606E77278050735DADF03A0427B6F237E1AE39B61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

77948

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

64BitMAPIBroker.pdb

kernel32

GetLastError SetEvent CloseHandle CreateThread ResetEvent GetProcAddress LocalFree DeleteCriticalSection GetCurrentProcessId GetModuleHandleW TransactNamedPipe GetFileType CreateEventA WaitNamedPipeW ConnectNamedPipe LocalAlloc VerSetConditionMask VerifyVersionInfoW SleepConditionVariableCS InitializeCriticalSectionEx DisconnectNamedPipe CreateNamedPipeA WaitForMultipleObjects PeekNamedPipe OpenProcess GetOverlappedResult FlushFileBuffers WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable LoadLibraryA FreeLibrary WideCharToMultiByte GetCommandLineA Sleep CreateFileW WaitForSingleObject WriteConsoleW SetFilePointerEx GetConsoleMode CreateMutexW InitializeCriticalSection LeaveCriticalSection CreateNamedPipeW WriteFile GetCurrentProcess EnterCriticalSection SetLastError SetNamedPipeHandleState RaiseException GetConsoleCP HeapReAlloc MultiByteToWideChar TlsAlloc TlsGetValue TlsSetValue TlsFree CreateSemaphoreA GetCurrentThread InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW RtlUnwindEx RtlPcToFileHeader EncodePointer LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle GetACP HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetProcessHeap SetStdHandle GetStringTypeW HeapSize ReadFile

user32

TranslateMessage DispatchMessageA GetMessageA

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorA RegCloseKey RegQueryValueExA RegOpenKeyExA OpenProcessToken GetTokenInformation OpenThreadToken ConvertSidToStringSidA

shell32

SHGetFileInfoW

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_9a561d3f7b73c809c443dfff6f5d82c0_cobalt-strike_icedid_njrat_vidar

kernel32

user32

advapi32

shell32

generic