2026-10-28_cde9aae0fce82040890beb72c650e3bc_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-28_cde9aae0fce82040890beb72c650e3bc_cobalt-strike_icedid_njrat_vidar
Size 3.6MB
Sample261029-wr8easbh46
SHA256 12a896df34f58bc4fdeda758257e09c5bdcfa6a28dee74ddf6c490505c879fc3
MD5 cde9aae0fce82040890beb72c650e3bc
SHA1 9b4ad63c623117bf835525e21fc20b6cc9cdf011
SHA512 767567b1872d6cc9835cd63c56ff2c4c2eacc568d8e9921187e400232c78ea1694d5b44ee1d94886c3cc3154aaa52de5d27fbc5518f09dc0bad755d1f1852021
SSDEEP 49152:4PxROIMNYm+x72JWfR83BFJjG/CScvcaI9ivy7i20f1j8yee30jaNf1TWbdz:axROIYeyWfRiBftIVSfJKU023W
TLSH
T1BD06AF5B72AD01E8E077D17CC9465B06F7B278055722A7CB12F486AA1F27BE14E7E320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-28_cde9aae0fce82040890beb72c650e3bc_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-10-28_cde9aae0fce82040890beb72c650e3bc_cobalt-strike_icedid_njrat_vidar

.exe 3.6MB

2026-10-28_cde9aae0fce82040890beb72c650e3bc_cobalt-strike_icedid_njrat_vidar

IMPHASH a8ac88dc7ae327720be4445394838726
SHA256 12a896df34f58bc4fdeda758257e09c5bdcfa6a28dee74ddf6c490505c879fc3
MD5 cde9aae0fce82040890beb72c650e3bc
SHA1 9b4ad63c623117bf835525e21fc20b6cc9cdf011
SHA512 767567b1872d6cc9835cd63c56ff2c4c2eacc568d8e9921187e400232c78ea1694d5b44ee1d94886c3cc3154aaa52de5d27fbc5518f09dc0bad755d1f1852021
SSDEEP 49152:4PxROIMNYm+x72JWfR83BFJjG/CScvcaI9ivy7i20f1j8yee30jaNf1TWbdz:axROIYeyWfRiBftIVSfJKU023W
TLSH
T1BD06AF5B72AD01E8E077D17CC9465B06F7B278055722A7CB12F486AA1F27BE14E7E320
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1397456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qba1\workspace\17493\SSE_Storage_Common\build\iaStorAfs\package\x64\Release\iaStorAfsService.pdb

kernel32

FindNextFileNameW LocalFree GetCommandLineA TlsSetValue CreateEventW ResetEvent Sleep WaitForMultipleObjects InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetModuleHandleW GetProcAddress CreateFileW DeviceIoControl GetCommandLineW MultiByteToWideChar InitializeCriticalSectionAndSpinCount FindFirstFileExW OutputDebugStringW QueryPerformanceCounter ReadFile WriteFile DeleteFileW GetModuleFileNameW GetEnvironmentStringsW FreeEnvironmentStringsW GetCurrentThread DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize GetTickCount64 CreateTimerQueue CreateTimerQueueTimer DeleteTimerQueueEx GetSystemDirectoryW FindFirstFileNameW GetFinalPathNameByHandleW OpenFileById FindFirstFileW FindNextFileW GetCurrentProcess SetPriorityClass DeleteTimerQueueTimer GetSystemPowerStatus HeapFree TryEnterCriticalSection CreateDirectoryW GetFileAttributesW SetFileAttributesW InitializeCriticalSection ExitProcess TlsAlloc TlsFree HeapReAlloc MoveFileW HeapAlloc HeapDestroy GetLastError CloseHandle DecodePointer WaitForSingleObject SetEvent SetEnvironmentVariableW HeapCreate GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile TlsGetValue CompareFileTime ExpandEnvironmentStringsW GetSystemTime SystemTimeToFileTime SuspendThread ResumeThread FindClose lstrlenW GetOverlappedResult CancelIoEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError TerminateProcess IsProcessorFeaturePresent GetSystemInfo VirtualAlloc VirtualProtect VirtualQuery CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW GetCurrentThreadId HeapQueryInformation FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetFileType GetStartupInfoW RaiseException GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode WideCharToMultiByte SetConsoleCtrlHandler IsValidCodePage GetACP GetOEMCP GetCPInfo GetStringTypeW SetStdHandle ReadConsoleW WriteConsoleW RtlUnwindEx RtlPcToFileHeader RtlUnwind EncodePointer InterlockedFlushSList ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetCurrentProcessId FormatMessageA LCMapStringEx GetLocaleInfoEx CompareStringEx SetFilePointer FileTimeToLocalFileTime GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW UnmapViewOfFile FileTimeToSystemTime HeapValidate GetTempPathA FormatMessageW LeaveCriticalSection AreFileApisANSI EnterCriticalSection GetTickCount MapViewOfFile CreateFileMappingW GetFileSize LockFileEx UnlockFile HeapCompact LoadLibraryW DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTimeZoneInformation

advapi32

DeregisterEventSource ReportEventW ConvertStringSecurityDescriptorToSecurityDescriptorW TraceMessage GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle UnregisterTraceGuids RegisterTraceGuidsW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerExW RegisterEventSourceW QueryServiceStatusEx OpenServiceW ChangeServiceConfigW QueryServiceConfigW StartServiceW EnumDependentServicesW OpenThreadToken CopySid EqualSid GetLengthSid GetSidLengthRequired GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation InitializeSid IsValidSid ControlService DeleteService RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey ChangeServiceConfig2W OpenSCManagerW AllocateAndInitializeSid FreeSid InitializeSecurityDescriptor SetSecurityDescriptorDacl CloseServiceHandle SetEntriesInAclW CreateServiceW RegDeleteTreeW RegCreateKeyExW

shlwapi

PathIsDirectoryW PathFindExtensionW PathFindFileNameW PathIsRelativeW PathFileExistsW PathRemoveFileSpecW

rpcrt4

RpcServerUseProtseqEpW RpcImpersonateClient RpcRevertToSelf RpcMgmtStopServerListening RpcMgmtWaitServerListen RpcEpRegisterW NdrAsyncServerCall NdrServerCallAll Ndr64AsyncServerCallAll NdrServerCall2 RpcEpUnregister RpcServerTestCancel RpcAsyncCompleteCall RpcBindingVectorFree RpcServerInqBindings RpcServerUnregisterIf RpcServerListen RpcAsyncAbortCall RpcServerRegisterIf3

userenv

UnloadUserProfile

api-ms-win-security-base-l1-2-2

DeriveCapabilitySidsFromName

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoRegisterClassObject CoRevokeClassObject CoSetProxyBlanket

oleaut32

VariantInit VariantClear SysAllocString SetErrorInfo VariantChangeType GetErrorInfo CreateErrorInfo SysFreeString

fltlib

FilterReplyMessage FilterGetMessage FilterSendMessage FilterConnectCommunicationPort

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification PowerSettingUnregisterNotification

user32

LoadStringW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

498KB

Virtual Size

497KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

44KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

580KB

Virtual Size

584KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-28_cde9aae0fce82040890beb72c650e3bc_cobalt-strike_icedid_njrat_vidar

kernel32

advapi32

shlwapi

rpcrt4

userenv

api-ms-win-security-base-l1-2-2

ole32

oleaut32

fltlib

api-ms-win-power-setting-l1-1-0

user32

api-ms-win-core-winrt-error-l1-1-0

generic