2026-09-19_962f97bb226ab2047d977e10eb2089ba_cobalt-strike_icedid_njrat_vidar

General

Target
2026-09-19_962f97bb226ab2047d977e10eb2089ba_cobalt-strike_icedid_njrat_vidar
Size 510KB
Sample260919-sdvdqsdj5x
SHA256 b7bab02b00c6d326e7e69d01711885e16d1676f1f0850af325848a5ee3ae5fd0
MD5 962f97bb226ab2047d977e10eb2089ba
SHA1 c134bfacf0abd78bf7f6ea683c3d8bdbe11b380e
SHA512 79f360d641d923e7c8e2abdf05119ad086c8cfc533795611ffa967f2b5de56a859b794643390e5fa7102503559eb3160114549fece75b7e73e2cc7191348a5a2
SSDEEP 6144:W4xc5SdMmOKkKnIwtyIyEv/IHwY+gVpV7GvYlo:reIMmOKLIpI1kwYD7GL
TLSH
T146B46A46735501F5D077D138CB734BE2EB7A3C155721D34E03AC676A5F2B2A0BA2AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-09-19_962f97bb226ab2047d977e10eb2089ba_cobalt-strike_icedid_njrat_vidar

.exe 510KB

2026-09-19_962f97bb226ab2047d977e10eb2089ba_cobalt-strike_icedid_njrat_vidar

IMPHASH d1d17b8cf72951bd4f27b7091efa224e
SHA256 b7bab02b00c6d326e7e69d01711885e16d1676f1f0850af325848a5ee3ae5fd0
MD5 962f97bb226ab2047d977e10eb2089ba
SHA1 c134bfacf0abd78bf7f6ea683c3d8bdbe11b380e
SHA512 79f360d641d923e7c8e2abdf05119ad086c8cfc533795611ffa967f2b5de56a859b794643390e5fa7102503559eb3160114549fece75b7e73e2cc7191348a5a2
SSDEEP 6144:W4xc5SdMmOKkKnIwtyIyEv/IHwY+gVpV7GvYlo:reIMmOKLIpI1kwYD7GL
TLSH
T146B46A46735501F5D077D138CB734BE2EB7A3C155721D34E03AC676A5F2B2A0BA2AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

74:3b:08:b0:ec:02:3e:d0:0e:51:33:60:cf:62:1d:9d:ab:4c:48:4f:05:1d:d5:8f:2e:61:cf:c4:b6:c9:6c:49

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Python Software Foundation,O=Python Software Foundation,L=Wolfeboro,ST=New Hampshire,C=US

Chains

Mar 25, 2019

CN=Python Software Foundation,O=Python Software Foundation,L=Wolfeboro,ST=New Hampshire,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Python Software Foundation,O=Python Software Foundation,L=Wolfeboro,ST=New Hampshire,C=US

Serial Number

03:3e:d5:ed:a0:65:d1:b8:c9:1d:fc:f9:2a:6c:9b:d8

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 18, 2018 - Dec 22, 2021

Minor OS version

0

Major OS version

6

Entry point

12936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\_work\5\s\PCbuild\amd64\venvlauncher.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

SetConsoleCtrlHandler SetInformationJobObject QueryInformationJobObject GetBinaryTypeW GetCommandLineW GetCurrentProcess GetStdHandle AssignProcessToJobObject GetModuleFileNameW SetEnvironmentVariableW GetEnvironmentVariableW GetStartupInfoW DuplicateHandle MultiByteToWideChar GetPrivateProfileStringW FormatMessageW GetLastError WaitForSingleObjectEx CloseHandle CreateJobObjectA CreateProcessW GetExitCodeProcess HeapSize HeapReAlloc WriteConsoleW SetEndOfFile GetFileAttributesW InitializeCriticalSectionAndSpinCount RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW WriteFile GetCommandLineA HeapFree HeapAlloc GetCurrentThread GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode GetStringTypeW ReadFile ReadConsoleW OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap GetFileSizeEx SetFilePointerEx CreateFileW

advapi32

RegEnumKeyW RegOpenKeyExW RegQueryValueExW RegCloseKey

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-19_962f97bb226ab2047d977e10eb2089ba_cobalt-strike_icedid_njrat_vidar

version

kernel32

advapi32

generic