2026-10-26_5e57e2155965161210d03202564e8d39_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_5e57e2155965161210d03202564e8d39_cobalt-strike_icedid_njrat_vidar
Size 589KB
Sample261027-ts2a9sev3w
SHA256 f3b8ce0dddcc7cf433a50707b6a2b2265e5d7ea69e65fb76e3280b588b9a8732
MD5 5e57e2155965161210d03202564e8d39
SHA1 d813de75fd1d6e0c103381b4ccc49fc84318fba8
SHA512 180850d5489745afa2d2a6cc2bbbb2dcd2f980d91d5ef629e9fcb0fe9128834104e379520981577bc8cd31ec45ca99ada03a9f030df2cf46ee9cc46703153868
SSDEEP 12288:1cdBvMUGDV6ZNPjjmPXWDTm7Gj3inpHrwv3TwhMKnNhmizugdNxNF9Zp:1CBvqmyNhmGNxNF9T
TLSH
T17BD47C5673E002F5F5B7D139CA55CA95FAB2BC050724A78B03E446A72F233A05B7E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-26_5e57e2155965161210d03202564e8d39_cobalt-strike_icedid_njrat_vidar

.exe 589KB

2026-10-26_5e57e2155965161210d03202564e8d39_cobalt-strike_icedid_njrat_vidar

IMPHASH 96ce7a735067e058f9a2720324c81f73
SHA256 f3b8ce0dddcc7cf433a50707b6a2b2265e5d7ea69e65fb76e3280b588b9a8732
MD5 5e57e2155965161210d03202564e8d39
SHA1 d813de75fd1d6e0c103381b4ccc49fc84318fba8
SHA512 180850d5489745afa2d2a6cc2bbbb2dcd2f980d91d5ef629e9fcb0fe9128834104e379520981577bc8cd31ec45ca99ada03a9f030df2cf46ee9cc46703153868
SSDEEP 12288:1cdBvMUGDV6ZNPjjmPXWDTm7Gj3inpHrwv3TwhMKnNhmizugdNxNF9Zp:1CBvqmyNhmGNxNF9T
TLSH
T17BD47C5673E002F5F5B7D139CA55CA95FAB2BC050724A78B03E446A72F233A05B7E722
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

5e:f5:c6:b4:d9:7b:c2:0f:82:f2:0b:bf:3b:eb:80:a9:56:10:e0:7f:f0:6c:08:21:30:d4:eb:fc:15:70:05:4a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Open Source Developer Rudi De Vos,O=Open Source Developer,L=Antwerpen,C=BE

Chains

Oct 24, 2026

CN=Open Source Developer Rudi De Vos,O=Open Source Developer,L=Antwerpen,C=BE

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Open Source Developer Rudi De Vos,O=Open Source Developer,L=Antwerpen,C=BE

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Open Source Developer Rudi De Vos,O=Open Source Developer,L=Antwerpen,C=BE

Serial Number

26:bb:92:42:35:22:ba:ce:ae:a3:f0:44:80:0e:83:48

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 5, 2026 - Sep 5, 2027

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

16820

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\rudi\Desktop\git_ultravnc\addon\ms-logon\MSLogonACL\x64\Release\MSLogonACL.pdb

netapi32

NetApiBufferFree NetWkstaGetInfo

kernel32

ReadConsoleW GetComputerNameW HeapAlloc GetLastError GetProcessHeap LocalFree HeapFree SetEndOfFile WriteConsoleW TlsGetValue RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc RtlUnwind TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetCurrentThread FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW SetConsoleCtrlHandler FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx CloseHandle CreateFileW HeapSize HeapReAlloc ReadFile

advapi32

IsValidSid RegCreateKeyExW CopySid RegSetValueExW AddAccessDeniedAce InitializeAcl GetLengthSid AddAccessAllowedAce LookupAccountNameW RegCloseKey GetSidIdentifierAuthority RegQueryValueExW LookupAccountSidW RegOpenKeyExW GetAce GetSidSubAuthority GetSidSubAuthorityCount GetAclInformation

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_5e57e2155965161210d03202564e8d39_cobalt-strike_icedid_njrat_vidar

netapi32

kernel32

advapi32

generic