4236a5066d71d5a899a76940c9110640949733bbbe7a4684e5971803f7c7de39

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 14:19

Target
2026-10-06_3554950d681990df3c8cf2502cbdb1f7_cobalt-strike_icedid_njrat_vidar.exe
Size 456KB
Sample261006-rmybbafc28
SHA256 4236a5066d71d5a899a76940c9110640949733bbbe7a4684e5971803f7c7de39
MD5 3554950d681990df3c8cf2502cbdb1f7
SHA1 c7ef2a036cfd21fea6c196edb92ed7952c3f4049
SHA512 d504eb59247d635ad9ca07da3db7c90b768ff37c2810ecda19da8018d1fe48bc818b9c7a32d717c5cbb0faea54e758a20265f3db21bc41bcbfa421261b66d681
SSDEEP 6144:ofcy6czjzg5wvoTQ/ZKyLnbjS+r1EDSqjaL9ZwohnSsDyhWCEjZ+3Jy:ofcyxYuvj/4Ibj2DSzcoZ5iWn1+s
TLSH
T165A46C15B7A544F5E077C13889A28645EAB27C550B71D76F03A8D27A2F333A09E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\Binaries	2026-10-06_3554950d681990df3c8cf2502cbdb1f7_cobalt-strike_icedid_njrat_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-10-06_3554950d681990df3c8cf2502cbdb1f7_cobalt-strike_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-06_3554950d681990df3c8cf2502cbdb1f7_cobalt-strike_icedid_njrat_vidar.exe"
1⤵
- Checks for any installed AV software in registry
PID:600

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Software Discovery

Security Software Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact