2026-10-16_de5cbfb556a48830b89ed4e916dafa02_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_de5cbfb556a48830b89ed4e916dafa02_cobalt-strike_icedid_njrat_vidar
Size 1.2MB
Sample261017-frxpssdc39
SHA256 5cd324d3f6a0658cc6e70dbb75190a722311e1a10278e2932f45ee3ccd102456
MD5 de5cbfb556a48830b89ed4e916dafa02
SHA1 ca98c55f0c0726edafd3278110a586045a108af3
SHA512 b8c60e7f886a0f9455be186e8c1f3dbf8d13391e8de33580c3f7b1be3d9ff4569f9d095376312204363702b7cb194811020de721210c202f4e76ca29e873ea43
SSDEEP 12288:ljZMm2pivG//MhvT9F50EQ3M9LeuYsSuroy5SWUBCnVySFjgxa55uAgi85bpRaT0:Fem2pB/8hySFj15u/KSWITnbD2sKJdj
TLSH
T1BC45E16637A815E6D077C13EC585CBA9FBB2BC110720A7CB0194556A2E23EE85F3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_de5cbfb556a48830b89ed4e916dafa02_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-10-16_de5cbfb556a48830b89ed4e916dafa02_cobalt-strike_icedid_njrat_vidar

.exe 1.2MB

2026-10-16_de5cbfb556a48830b89ed4e916dafa02_cobalt-strike_icedid_njrat_vidar

IMPHASH be1c55772ae5250f119652c4ddaf8dfe
SHA256 5cd324d3f6a0658cc6e70dbb75190a722311e1a10278e2932f45ee3ccd102456
MD5 de5cbfb556a48830b89ed4e916dafa02
SHA1 ca98c55f0c0726edafd3278110a586045a108af3
SHA512 b8c60e7f886a0f9455be186e8c1f3dbf8d13391e8de33580c3f7b1be3d9ff4569f9d095376312204363702b7cb194811020de721210c202f4e76ca29e873ea43
SSDEEP 12288:ljZMm2pivG//MhvT9F50EQ3M9LeuYsSuroy5SWUBCnVySFjgxa55uAgi85bpRaT0:Fem2pB/8hySFj15u/KSWITnbD2sKJdj
TLSH
T1BC45E16637A815E6D077C13EC585CBA9FBB2BC110720A7CB0194556A2E23EE85F3F721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11751

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\76724\minidump_stackwalk\build\RelWithDebInfo\minidump_stackwalk.pdb

minidump_stackwalk

?mdsw_unloaded_module_name_destroy@@YAXPEAPEAUmdsw_unloaded_module_names_s@@@Z ?mdsw_unloaded_module_destroy@@YAXPEAPEAUmdsw_unloaded_modules_s@@@Z ?mdsw_loaded_module_name_destroy@@YAXPEAPEAUmdsw_loaded_module_names_s@@@Z ?mdsw_loaded_module_destroy@@YAXPEAPEAUmdsw_loaded_modules_s@@@Z ?mdsw_crash_module_destroy@@YAXPEAPEAUmdsw_crash_modules_s@@@Z ?mdsw_threads_stack_destroy@@YAXPEAPEAUmdsw_threads_stack_s@@@Z ?mdsw_crash_stack_destroy@@YAXPEAPEAUmdsw_crash_stack_s@@@Z ?mdsw_except_info_destroy@@YAXPEAPEAUmdsw_except_info_s@@@Z ?mdsw_system_info_destroy@@YAXPEAPEAUmdsw_system_info_s@@@Z ?mdsw_destroy@@YAXPEAPEAX@Z ?mdsw_create@@YA_NPEAPEAX@Z ?mdsw_get_unloaded_modules@@YA_NPEAXPEAPEAUmdsw_unloaded_modules_s@@@Z ?mdsw_get_loaded_module_names@@YA_NPEAXPEAPEAUmdsw_loaded_module_names_s@@@Z ?mdsw_get_loaded_modules@@YA_NPEAXPEAPEAUmdsw_loaded_modules_s@@@Z ?mdsw_get_crash_modules@@YA_NPEAXPEAPEAUmdsw_crash_modules_s@@@Z ?mdsw_get_threads_stack@@YA_NPEAXPEAPEAUmdsw_threads_stack_s@@@Z ?mdsw_get_crash_stack@@YA_NPEAXPEAPEAUmdsw_crash_stack_s@@@Z ?mdsw_get_except_info@@YA_NPEAXPEAPEAUmdsw_except_info_s@@@Z ?mdsw_get_system_info@@YA_NPEAXPEAPEAUmdsw_system_info_s@@@Z ?mdsw_parse_dump@@YA_NPEAXPEB_WQEAY0BAE@$$CB_W@Z ?mdsw_get_unloaded_module_names@@YA_NPEAXPEAPEAUmdsw_unloaded_module_names_s@@@Z

kernel32

RaiseException WriteConsoleW CreateFileW ReadConsoleW ReadFile CloseHandle HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetConsoleCtrlHandler GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RtlUnwind RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetCurrentThread OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo

Name

.text

Size

496KB

Virtual Size

495KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

562B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_de5cbfb556a48830b89ed4e916dafa02_cobalt-strike_icedid_njrat_vidar

minidump_stackwalk

kernel32

generic