2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar
Size 3.1MB
Sample260928-vctrxsbh49
SHA256 de121e718ed696cd4d2b7b29b43e904465977a14c358b167fbaf8302dd70a83a
MD5 355d7e19db6662e45b86c493d2e14e04
SHA1 f7331bcd3221d44da94307f1f4c79c5c33ddfda3
SHA512 899c8a17ce3878b7d6515ba891f856370dfb4d03a0da17fa78c62216df4c3b2cef13550b1b734f89bdd64c673569cfe47b127d290a7dfafdd2fd75eb12114658
SSDEEP 98304:nGIetVu0VLGMb5Cx0taAUgLdpq+Xvna9k7VoiX996Kc2Dfb9s/JTHfb9s:ZetVu0VLGMb5Cx0taAUgLdpq+Xvna9kE
TLSH
T1AFE5E05A679C00E9D167937889E68906D2B23C06B7618BCF03A57B6D2F336E05E3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar

.exe 3.1MB

2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar

IMPHASH 9f82fb27298864b5ec1780ba5ae94243
SHA256 de121e718ed696cd4d2b7b29b43e904465977a14c358b167fbaf8302dd70a83a
MD5 355d7e19db6662e45b86c493d2e14e04
SHA1 f7331bcd3221d44da94307f1f4c79c5c33ddfda3
SHA512 899c8a17ce3878b7d6515ba891f856370dfb4d03a0da17fa78c62216df4c3b2cef13550b1b734f89bdd64c673569cfe47b127d290a7dfafdd2fd75eb12114658
SSDEEP 98304:nGIetVu0VLGMb5Cx0taAUgLdpq+Xvna9k7VoiX996Kc2Dfb9s/JTHfb9s:ZetVu0VLGMb5Cx0taAUgLdpq+Xvna9kE
TLSH
T1AFE5E05A679C00E9D167937889E68906D2B23C06B7618BCF03A57B6D2F336E05E3F315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

302208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\workspace\sed\build\win64\Release\SEDcli\SEDcli.pdb

bcrypt

BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptGenRandom BCryptDeriveKeyPBKDF2

advapi32

RegEnumKeyExW CloseServiceHandle ConvertSidToStringSidA IsWellKnownSid OpenProcessToken RegSetValueW QueryServiceStatusEx RegOpenKeyExW StartServiceA DeleteService RegCreateKeyExW RegDeleteKeyW OpenSCManagerW CreateServiceW RegQueryValueExW RegGetValueW RegSetValueExA RegSetValueExW RegCloseKey GetTokenInformation

kernel32

ReadFile GetConsoleMode GetConsoleOutputCP TerminateProcess InitializeCriticalSectionEx OpenProcess Sleep GetLastError ReadConsoleW DecodePointer DeleteCriticalSection CloseHandle CreateProcessW GetCurrentProcess OutputDebugStringA GetCurrentProcessId SetEnvironmentVariableW SetSearchPathMode HeapSetInformation GetProcAddress GetProcessHeap GetModuleHandleW SetDllDirectoryW CreateWaitableTimerW CreateEventW FindClose FreeEnvironmentStringsW FindCloseChangeNotification LocalFree FreeLibrary FormatMessageW MultiByteToWideChar WideCharToMultiByte FlushFileBuffers GetFileSizeEx GetTimeZoneInformation HeapReAlloc RaiseException OutputDebugStringW WaitForSingleObject SetEvent GetQueuedCompletionStatus LoadLibraryW CreateIoCompletionPort GetCurrentThreadId ExitThread GetCurrentThread CreateThread ResetEvent EnterCriticalSection LeaveCriticalSection InitializeCriticalSection LocalFileTimeToFileTime GetTickCount64 FileTimeToLocalFileTime GetSystemTimeAsFileTime GetSystemTime InitializeCriticalSectionAndSpinCount WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter InitializeSListHead RtlUnwind FormatMessageA SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetEndOfFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime GetTempPathW AreFileApisANSI DeviceIoControl CreateDirectoryExW CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW InitOnceExecuteOnce GetStringTypeW LCMapStringEx EncodePointer GetLocaleInfoEx CompareStringEx GetCPInfo GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetConsoleCtrlHandler SetStdHandle IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW HeapSize

user32

UnregisterClassW GetSystemMetrics

ole32

CoTaskMemFree

Name

.text

Size

818KB

Virtual Size

817KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

185KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

232KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

UPX1

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-28_355d7e19db6662e45b86c493d2e14e04_cobalt-strike_icedid_njrat_vidar

bcrypt

advapi32

kernel32

user32

ole32

generic