2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar
Size 1.2MB
Sample261002-f95s5aaa52
SHA256 8dd06154c063ae9865a62eca4316481b0dfd2234c79f0b0404ca7f60e92ac828
MD5 b1ddff6953995a594ad6eef86c46430e
SHA1 ec72c56e13052c9cbd4f2fb58d5975fb91cf4a5a
SHA512 d99e876d4eb26afb7331dcaa8baa19105b744b4a2479c02a1b87af869c87add29dfb332971bd0d686bcc13426d40b160df19dbe2f8bca0fd9b39984a33e3dafd
SSDEEP 24576:63WpRwENzlNhc5mVpKdwqrF+L6VMRCPU6CENltmVVdpx7fLrQWd:dImV0616ZU6CENlc7dpJLrQWd
TLSH
T197459C4663EC42E4F1F3A7389972855ADB72BC515B35C6CF0264561E0E73AD08E3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar

File Explorer

2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar

.exe 1.2MB

2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar

IMPHASH 69ad4d171a0b2aa408cedd1cd7f86b69
SHA256 8dd06154c063ae9865a62eca4316481b0dfd2234c79f0b0404ca7f60e92ac828
MD5 b1ddff6953995a594ad6eef86c46430e
SHA1 ec72c56e13052c9cbd4f2fb58d5975fb91cf4a5a
SHA512 d99e876d4eb26afb7331dcaa8baa19105b744b4a2479c02a1b87af869c87add29dfb332971bd0d686bcc13426d40b160df19dbe2f8bca0fd9b39984a33e3dafd
SSDEEP 24576:63WpRwENzlNhc5mVpKdwqrF+L6VMRCPU6CENltmVVdpx7fLrQWd:dImV0616ZU6CENlc7dpJLrQWd
TLSH
T197459C4663EC42E4F1F3A7389972855ADB72BC515B35C6CF0264561E0E73AD08E3AB23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

208944

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\T\Acrobat\Installers\BootStrapExe_Small\Release_x64\Setup.pdb

kernel32

LocalReAlloc GlobalFlags GetLocaleInfoW GetSystemDefaultUILanguage VirtualProtect GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFileTime SetErrorMode VirtualQuery LoadLibraryExA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead GlobalHandle GetStartupInfoW GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GetCurrentProcessId WritePrivateProfileStringW GetPrivateProfileIntW SetEnvironmentVariableW GetCurrentThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FileTimeToLocalFileTime DuplicateHandle WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers lstrcmpA SuspendThread SetThreadPriority CreateEventW SetEvent CompareStringW GlobalFindAtomW GlobalAddAtomW GlobalDeleteAtom OutputDebugStringW RtlUnwindEx RtlPcToFileHeader CreateThread ExitThread FreeLibraryAndExitThread SetStdHandle GetFileType GetCommandLineA GetCommandLineW HeapQueryInformation GetStdHandle ExitProcess LCMapStringW GetConsoleOutputCP GetConsoleMode ReadConsoleW SetFilePointerEx GetDriveTypeW GetTimeZoneInformation FindFirstFileExW IsValidCodePage LoadLibraryExW GetCurrentThreadId EncodePointer MulDiv GlobalFree GlobalLock GlobalUnlock GlobalAlloc QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW GetModuleHandleExW InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection OutputDebugStringA GetACP WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection InitializeCriticalSectionEx GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW LocalAlloc GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc RaiseException DecodePointer GetUserDefaultUILanguage GetPrivateProfileStringW lstrlenW lstrcmpW GetModuleFileNameW GetVersionExW GetSystemInfo GetCurrentProcess GetTempFileNameW FindNextFileW FindFirstFileW FindClose DeleteFileW ExpandEnvironmentStringsW GetTempPathW CopyFileW GetSystemDirectoryW CreateProcessW GetExitCodeProcess WaitForSingleObject SetLastError GetLastError CloseHandle CreateFileW GetCurrentDirectoryW GetUserDefaultLangID LoadLibraryW FreeLibrary ResumeThread Sleep FormatMessageW LocalFree FindResourceW SizeofResource LockResource LoadResource SetDllDirectoryW GetProcAddress GetModuleHandleW GetSystemWindowsDirectoryW SetCurrentDirectoryW GetStringTypeW WriteConsoleW IsDebuggerPresent

user32

InvalidateRect DestroyMenu TabbedTextOutW GrayStringW DrawTextExW DrawTextW RealChildWindowFromPoint ClientToScreen LoadCursorW GetSysColorBrush ReleaseDC GetDC GetWindowThreadProcessId SetCursor PostQuitMessage GetSystemMetrics CharUpperW GetCursorPos TranslateMessage GetMessageW GetDesktopWindow GetActiveWindow GetNextDlgTabItem CreateDialogIndirectParamW MonitorFromWindow WinHelpW LoadIconW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetTopWindow GetClassNameW GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW PtInRect CopyRect GetSysColor MapWindowPoints ScreenToClient MessageBoxW AdjustWindowRectEx GetWindowRect RemovePropW GetPropW SetPropW GetScrollPos RedrawWindow ValidateRect EndPaint BeginPaint SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow SetMenu GetMenu GetCapture GetKeyState IsIconic IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos DestroyWindow IsChild IsMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos PeekMessageW DispatchMessageW RegisterWindowMessageW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem IsDialogMessageW GetWindow SetWindowLongW GetWindowLongW GetWindowTextW SetWindowTextW IsWindowEnabled GetFocus SetFocus GetDlgCtrlID GetDlgItem SetWindowPos ShowWindow IsWindow GetMenuItemCount GetMenuItemID GetSubMenu GetParent OffsetRect SetRectEmpty GetClientRect SendDlgItemMessageA UnregisterClassW EndDialog PostMessageW EnableWindow KillTimer SetTimer SendMessageW GetMonitorInfoW

gdi32

SetViewportExtEx SetViewportOrgEx SetWindowExtEx OffsetViewportOrgEx ScaleViewportExtEx ScaleWindowExtEx ExtTextOutW TextOutW SetMapMode SelectObject SaveDC RestoreDC RectVisible PtVisible GetStockObject GetClipBox Escape DeleteDC GetDeviceCaps CreateBitmap SetBkColor SetTextColor GetObjectW DeleteObject

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegEnumValueW RegQueryValueW RegEnumKeyW RegDeleteValueW RegDeleteKeyW QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle InitiateSystemShutdownW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteKeyExW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

shell32

SHGetKnownFolderPath ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathFileExistsW PathRemoveFileSpecW PathIsUNCW PathStripToRootW PathFindExtensionW PathFindFileNameW

ole32

CoTaskMemFree CoCreateInstance CoCreateGuid CoInitialize CoUninitialize

oleaut32

SysFreeString VariantInit VariantClear VariantChangeType SysAllocString

Name

.text

Size

337KB

Virtual Size

337KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

132KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

684KB

Virtual Size

688KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_b1ddff6953995a594ad6eef86c46430e_cobalt-strike_icedid_njrat_stealc_vidar

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

generic