2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar

General

Target
2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar
Size 2.8MB
Sample261023-th4cwaez2j
SHA256 036dfd78ff26d5a8f070f5a4730740a9c26649e0b5aa251d905208e754ec0a3c
MD5 e38a19f5a8f143695e9d0a0c3f7edb91
SHA1 b9a74a6a8717a26fe2eab221c7e88db4c4cc9cc1
SHA512 b5f0fce3194e5ab46d29636e6b43375c43f141b1ccd9a8d7798216f3476ff38d57ff4c8e9ffb4df23dadfaa996e9bf53e0ac4589bd2f561fb28be67f83888ad8
SSDEEP 49152:VA6TJHeYhORXVKHuPlk8OsEqYQVrarSj8RoTCCHDmg27RnWGj:tebRXSQlBRJTbD527BWG
TLSH
T1E9D5BF4773E801E8E0BBD278DE67950EEA7278460B3497CF06904A5A1F63BE14E7D721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar

.exe 2.8MB

2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar

IMPHASH 4b0d25b050e939e91e2c0ad0a2659530
SHA256 036dfd78ff26d5a8f070f5a4730740a9c26649e0b5aa251d905208e754ec0a3c
MD5 e38a19f5a8f143695e9d0a0c3f7edb91
SHA1 b9a74a6a8717a26fe2eab221c7e88db4c4cc9cc1
SHA512 b5f0fce3194e5ab46d29636e6b43375c43f141b1ccd9a8d7798216f3476ff38d57ff4c8e9ffb4df23dadfaa996e9bf53e0ac4589bd2f561fb28be67f83888ad8
SSDEEP 49152:VA6TJHeYhORXVKHuPlk8OsEqYQVrarSj8RoTCCHDmg27RnWGj:tebRXSQlBRJTbD527BWG
TLSH
T1E9D5BF4773E801E8E0BBD278DE67950EEA7278460B3497CF06904A5A1F63BE14E7D721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

665740

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\B\T\1c45ec11-761a-47cd-9f84-f90fce19cfd1\build\x64\Release\ModuleCoreService.pdb

kernel32

FreeLibrary GetLastError GetCurrentProcessId ProcessIdToSessionId TerminateProcess CloseHandle OpenProcess GetModuleHandleW Sleep SetUnhandledExceptionFilter GetModuleHandleExW GetModuleFileNameW GetCommandLineW HeapFree InitializeCriticalSectionEx HeapSize HeapReAlloc RaiseException HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap RtlCaptureStackBackTrace CreateFileW MoveFileW DeleteFileW ReadDirectoryChangesW GetLongPathNameW SleepEx CancelIoEx FindFirstFileW FindNextFileW FindClose lstrlenW RtlCaptureContext RaiseFailFastException WaitForSingleObject GetCurrentProcess GetExitCodeProcess CreateProcessW GetProcessId WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW VerSetConditionMask GetProcAddress VerifyVersionInfoW SetLastError LoadLibraryExW QueryFullProcessImageNameW InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared CreateThread GetWindowsDirectoryW GlobalFindAtomW SystemTimeToFileTime GetFullPathNameW EnterCriticalSection LeaveCriticalSection LoadLibraryW MultiByteToWideChar WideCharToMultiByte GetCurrentDirectoryW OutputDebugStringW GetModuleHandleA LocalAlloc FormatMessageA LockFileEx UnlockFileEx GlobalAddAtomW CopyFileW MoveFileExW ReplaceFileW DeleteFileA SetFileAttributesA GetTempPathA GetTempFileNameA QueryUnbiasedInterruptTime OpenEventW GetTickCount64 CreateDirectoryW GetFileAttributesW RemoveDirectoryW SetFileAttributesW FindResourceExW LoadResource LockResource SizeofResource FindResourceW LocalFree InitializeCriticalSectionAndSpinCount SetFilePointer WriteFile ReleaseMutex CreateMutexW GetCurrentThreadId GetLocalTime VirtualQuery K32GetProcessImageFileNameW K32GetModuleFileNameExW GetOverlappedResult GetNamedPipeServerProcessId GetSystemInfo VirtualProtect LoadLibraryExA ReadProcessMemory CreateEventW SetEvent WaitForMultipleObjects IsDebuggerPresent GetStringTypeW QueryPerformanceCounter QueryPerformanceFrequency TryEnterCriticalSection WaitForSingleObjectEx SwitchToThread GetExitCodeThread RtlPcToFileHeader InitOnceBeginInitialize InitOnceComplete FindFirstFileExW GetFileInformationByHandle SetEndOfFile SetFilePointerEx EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW ResetEvent RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetCurrentThread GetThreadTimes FreeLibraryAndExitThread GetVersionExW VirtualAlloc VirtualFree DuplicateHandle ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwindEx ExitThread ReadFile GetConsoleMode ReadConsoleW GetConsoleCP GetFileType GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetStdHandle GetCommandLineA GetDateFormatW GetTimeFormatW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation GetFileSizeEx FlushFileBuffers SetStdHandle IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW FormatMessageW WritePrivateProfileStringW WritePrivateProfileStructW CreateNamedPipeW ConnectNamedPipe WaitNamedPipeW SetNamedPipeHandleState DisconnectNamedPipe GetNamedPipeClientProcessId RtlUnwind

oleaut32

SysAllocString SysFreeString

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

356KB

Virtual Size

355KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

56KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_e38a19f5a8f143695e9d0a0c3f7edb91_cobalt-strike_icedid_njrat_vidar

kernel32

oleaut32

generic