2026-08-25_c89e357e6906dd6841e03be04dddaefc_cobalt-strike_icedid_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-25_c89e357e6906dd6841e03be04dddaefc_cobalt-strike_icedid_njrat_stealc_vidar
Size 1.0MB
Sample260826-lrh5astsds
SHA256 e088bccdb07ecef0a99e92c182c264c2f587a31075bcd5334e9a90075e87d1cb
MD5 c89e357e6906dd6841e03be04dddaefc
SHA1 12b1e0f0c06905d43342609e3236828798bd2c73
SHA512 e59b3aa49a294a0cbdc230fde1bd68315c8f953caaff229738fa590e8b1fd9ebebc83afea32df40c8374684f2a470134f2734e3826665484e9ce5ca6f5923876
SSDEEP 24576:kbMkcdQ3DwxeS9kaVzAebGv41NGg2mLkark3pcK+TeS0zgif:VkY6eelaVZbGv4xRoX3p7+CXzd
TLSH
T11335D08A676809F1D076917DCA52850BE7B2781807A097DF02A4E37E2F376D19D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-25_c89e357e6906dd6841e03be04dddaefc_cobalt-strike_icedid_njrat_stealc_vidar

File Explorer

2026-08-25_c89e357e6906dd6841e03be04dddaefc_cobalt-strike_icedid_njrat_stealc_vidar

.exe 1.0MB

2026-08-25_c89e357e6906dd6841e03be04dddaefc_cobalt-strike_icedid_njrat_stealc_vidar

IMPHASH 493d219cca3ad16d2cb41859649e1d1f
SHA256 e088bccdb07ecef0a99e92c182c264c2f587a31075bcd5334e9a90075e87d1cb
MD5 c89e357e6906dd6841e03be04dddaefc
SHA1 12b1e0f0c06905d43342609e3236828798bd2c73
SHA512 e59b3aa49a294a0cbdc230fde1bd68315c8f953caaff229738fa590e8b1fd9ebebc83afea32df40c8374684f2a470134f2734e3826665484e9ce5ca6f5923876
SSDEEP 24576:kbMkcdQ3DwxeS9kaVzAebGv41NGg2mLkark3pcK+TeS0zgif:VkY6eelaVZbGv4xRoX3p7+CXzd
TLSH
T11335D08A676809F1D076917DCA52850BE7B2781807A097DF02A4E37E2F376D19D3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

119248

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qb\workspace\21461\source\output\dump64\miniport\IntelCpLSPCONSvc\Release\IntelCpHDCPSvc.pdb

kernel32

HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap SleepEx GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo CreateFileW GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetCommandLineW ReleaseMutex WriteFile ReadFile SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetCurrentThreadId OutputDebugStringA CreateThread CreateSemaphoreExW ReleaseSemaphore SetEvent CloseHandle WriteConsoleW FreeLibrary SetFilePointerEx EnterCriticalSection LeaveCriticalSection GetModuleHandleW LoadLibraryExW LoadResource SizeofResource FindResourceW lstrcmpiW MultiByteToWideChar LoadLibraryW GetProcAddress GetCurrentProcessId DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException DecodePointer QueryPerformanceCounter Sleep CreateEventW WaitForMultipleObjects DeviceIoControl CreateMutexW WaitForSingleObject QueryPerformanceFrequency LCMapStringW GetOEMCP TryEnterCriticalSection SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount WideCharToMultiByte WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait EncodePointer GetCurrentThread GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA GetVersionExW VirtualAlloc VirtualProtect VirtualFree DuplicateHandle InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx CreateTimerQueue RtlUnwindEx RtlPcToFileHeader ExitProcess GetModuleHandleExW GetStdHandle GetFileType

advapi32

ControlService RegCloseKey EventUnregister RegCreateKeyExW NotifyServiceStatusChangeW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenServiceW OpenSCManagerW DeleteService CreateServiceW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegSetValueExW EventWrite ChangeServiceConfig2W CloseServiceHandle EventRegister ChangeServiceConfigW

user32

LoadStringW DispatchMessageW MessageBoxW EnumDisplayDevicesW GetMessageW TranslateMessage CharNextW CharUpperW PostThreadMessageW

oleaut32

VarUI4FromStr SafeArrayGetVartype SafeArrayCopy LoadRegTypeLi LoadTypeLi SafeArrayUnlock SysStringLen SafeArrayLock SafeArrayGetLBound SafeArrayGetUBound SafeArrayRedim SafeArrayDestroy SafeArrayCreate VariantInit VariantClear SysFreeString

setupapi

CM_Get_Device_Interface_ListW CM_Get_Device_Interface_List_SizeW

ole32

CoInitializeEx CoUninitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoInitializeSecurity CoReleaseServerProcess CoAddRefServerProcess CoRevokeClassObject CoSetProxyBlanket CoCreateInstance

api-ms-win-devices-config-l1-1-1

CM_MapCrToWin32Err CM_Unregister_Notification CM_Register_Notification

Name

.text

Size

321KB

Virtual Size

320KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

125KB

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-25_c89e357e6906dd6841e03be04dddaefc_cobalt-strike_icedid_njrat_stealc_vidar

kernel32

advapi32

user32

oleaut32

setupapi

ole32

api-ms-win-devices-config-l1-1-1

generic