2026-09-29_50bfb8ff9d0dc29c6ca09768b78386ec_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-29_50bfb8ff9d0dc29c6ca09768b78386ec_cobalt-strike_icedid_njrat_vidar
Size 2.2MB
Sample260930-blejta1s3m
SHA256 7bd8f3c4db6e30aedab02f17dee0428fefab3b72ef6120ac5c6e2c47013441b9
MD5 50bfb8ff9d0dc29c6ca09768b78386ec
SHA1 1a297a8069c2941c9412ded8a96f6911838469bd
SHA512 caa27d907f8b850bfbc660d9b9f60ef57cb11544da709ed7f6f7b828477b2c94157cd37f61fedd7d203a810292d8ae101808179b86ca124b186c466244584dcf
SSDEEP 24576:4kMPewiyYaquDd0cimETAFKSyne4GDo0Glwpxfw6rHp4jmEVaXJR20:VMPewiKquYmE4KZXGDvGlAfw6b4HOJ
TLSH
T1EAA5AE16E3DC0189E1B7927D89964B49E6B2F805033197CF01A446DE2F27BE94E3F7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-29_50bfb8ff9d0dc29c6ca09768b78386ec_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-09-29_50bfb8ff9d0dc29c6ca09768b78386ec_cobalt-strike_icedid_njrat_vidar

.exe 2.2MB

2026-09-29_50bfb8ff9d0dc29c6ca09768b78386ec_cobalt-strike_icedid_njrat_vidar

IMPHASH e9390588d542ddec04ab6acee3ed5c29
SHA256 7bd8f3c4db6e30aedab02f17dee0428fefab3b72ef6120ac5c6e2c47013441b9
MD5 50bfb8ff9d0dc29c6ca09768b78386ec
SHA1 1a297a8069c2941c9412ded8a96f6911838469bd
SHA512 caa27d907f8b850bfbc660d9b9f60ef57cb11544da709ed7f6f7b828477b2c94157cd37f61fedd7d203a810292d8ae101808179b86ca124b186c466244584dcf
SSDEEP 24576:4kMPewiyYaquDd0cimETAFKSyne4GDo0Glwpxfw6rHp4jmEVaXJR20:VMPewiKquYmE4KZXGDvGlAfw6b4HOJ
TLSH
T1EAA5AE16E3DC0189E1B7927D89964B49E6B2F805033197CF01A446DE2F27BE94E3F7A1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\home\jenkins\agent\workspace\AMING_Driver-ITS_release-jenkins\Release\bin\x64\Release\LNBITSSvc.pdb

kernel32

LoadLibraryW SetLastError DeviceIoControl HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap FreeLibrary WideCharToMultiByte LocalFree GetTickCount64 GetModuleFileNameW CopyFileW DeleteFileW MoveFileExW SetEndOfFile SetStdHandle SetEnvironmentVariableW GetSystemDirectoryW WaitForMultipleObjects Sleep OpenEventW CreateEventW ResetEvent SetEvent CreateFileW K32GetModuleFileNameExW K32EnumProcesses Process32NextW Process32FirstW CreateToolhelp32Snapshot WTSGetActiveConsoleSessionId QueryFullProcessImageNameW LoadLibraryExW GetProcAddress ReadProcessMemory OpenProcess ProcessIdToSessionId CreateProcessW GetCurrentProcessId GetCurrentProcess WaitForSingleObject CloseHandle DeleteCriticalSection InitializeCriticalSectionEx GetLastError OpenMutexW DecodePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileSizeEx SetConsoleCtrlHandler GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetCurrentThread GetCommandLineW GetCommandLineA WriteFile ExitProcess WriteConsoleW GetFileType GetStdHandle ReadFile GetFileAttributesExW CreateDirectoryW GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread CreateThread TlsFree TlsSetValue TlsGetValue TlsAlloc RtlUnwind InitializeCriticalSectionAndSpinCount InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlPcToFileHeader TerminateProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext MultiByteToWideChar IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection FormatMessageA GetStringTypeW WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetLocaleInfoEx EncodePointer LCMapStringEx QueryPerformanceCounter QueryPerformanceFrequency SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetFileInformationByHandleEx CreateSymbolicLinkW CompareStringEx GetCPInfo InitializeSListHead

user32

UnregisterClassW

advapi32

RegQueryInfoKeyW RegEnumKeyExW StartServiceW QueryServiceStatusEx OpenServiceW OpenSCManagerW EnumDependentServicesW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W RegDeleteTreeW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegNotifyChangeKeyValue RegCreateKeyExW RegCloseKey LookupPrivilegeValueW SetTokenInformation GetTokenInformation DuplicateTokenEx AdjustTokenPrivileges OpenProcessToken CreateProcessAsUserW

shell32

SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoInitializeSecurity CoInitializeEx CoCreateInstance CoSetProxyBlanket StringFromGUID2 CoUninitialize

oleaut32

SetErrorInfo VariantChangeType GetErrorInfo CreateErrorInfo SysStringByteLen SysAllocString BSTR_UserUnmarshal SysFreeString VariantClear VariantInit VariantCopy VarBstrCmp BSTR_UserFree LPSAFEARRAY_UserSize LPSAFEARRAY_UserMarshal LPSAFEARRAY_UserUnmarshal LPSAFEARRAY_UserFree SysAllocStringByteLen BSTR_UserSize SafeArrayUnaccessData BSTR_UserMarshal SafeArrayAccessData

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken

rpcrt4

NdrServerCall2 RpcStringFreeW RpcStringBindingComposeW RpcBindingFromStringBindingW RpcBindingFree NdrClientCall2

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInfo SetupDiGetClassDevsW CM_Get_DevNode_Status SetupDiGetClassDescriptionW SetupDiCallClassInstaller SetupDiRemoveDevice SetupDiGetDeviceRegistryPropertyW SetupDiSetClassInstallParamsW SetupDiEnumDeviceInterfaces SetupDiDestroyDeviceInfoList

api-ms-win-power-setting-l1-1-0

PowerSettingUnregisterNotification PowerSettingRegisterNotification PowerGetActiveScheme

dbghelp

MakeSureDirectoryPathExists

winmm

timeKillEvent timeSetEvent

Name

.text

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

255KB

Virtual Size

254KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1024B

Virtual Size

863B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

576KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-29_50bfb8ff9d0dc29c6ca09768b78386ec_cobalt-strike_icedid_njrat_vidar

kernel32

user32

advapi32

shell32

ole32

oleaut32

userenv

wtsapi32

rpcrt4

setupapi

api-ms-win-power-setting-l1-1-0

dbghelp

winmm

generic