2026-11-02_c6051ed9fe7ce99de497c00d53613f45_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_c6051ed9fe7ce99de497c00d53613f45_cobalt-strike_icedid_njrat_vidar
Size 752KB
Sample261102-25nvpsge44
SHA256 e24acbb3c48cb1d66f007252533bb0173a1a5e0937ee2c4525cd1b0d431869b5
MD5 c6051ed9fe7ce99de497c00d53613f45
SHA1 48debaf337b75e648c215936b2603354a454d438
SHA512 62a0ce7e42c37248523b9f897954e36998fd20d9a4625effd6ac7294f7827b12615a70b87069824668e7ba2db05654cad222f75864589eb1b4090e6a02319a08
SSDEEP 12288:lpHVhVhwpUNUJVBS86BmZ5a+rOv2yvYDeHN:DrwpUNUDBw8C+rHyQuN
TLSH
T1CBF49D56A7A002E9D43BD27AC64B4722FAB2B0051B3167DF03B886692F537E15B3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-02_c6051ed9fe7ce99de497c00d53613f45_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-11-02_c6051ed9fe7ce99de497c00d53613f45_cobalt-strike_icedid_njrat_vidar

.exe 752KB

2026-11-02_c6051ed9fe7ce99de497c00d53613f45_cobalt-strike_icedid_njrat_vidar

IMPHASH 3c2470ab28aeec70fa3fa02040c05ac7
SHA256 e24acbb3c48cb1d66f007252533bb0173a1a5e0937ee2c4525cd1b0d431869b5
MD5 c6051ed9fe7ce99de497c00d53613f45
SHA1 48debaf337b75e648c215936b2603354a454d438
SHA512 62a0ce7e42c37248523b9f897954e36998fd20d9a4625effd6ac7294f7827b12615a70b87069824668e7ba2db05654cad222f75864589eb1b4090e6a02319a08
SSDEEP 12288:lpHVhVhwpUNUJVBS86BmZ5a+rOv2yvYDeHN:DrwpUNUDBw8C+rHyQuN
TLSH
T1CBF49D56A7A002E9D43BD27AC64B4722FAB2B0051B3167DF03B886692F537E15B3F315
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

217052

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\constructicon\builds\gfx\three\20.40\drivers\2d\dal\eeu\build\client\wNow64a\B_rel\atieclxx.pdb

user32

SetTimer KillTimer UpdateWindow ShowWindow UnregisterPowerSettingNotification RegisterPowerSettingNotification SendMessageA UnregisterHotKey DestroyWindow DefWindowProcA PostQuitMessage RegisterClassA PostMessageA GetMessageA DispatchMessageA CreateWindowExA GetForegroundWindow FindWindowA ChangeWindowMessageFilter RegisterWindowMessageA wsprintfW GetPropA EnumWindows EnumDisplayDevicesA GetDisplayConfigBufferSizes QueryDisplayConfig EnumDisplaySettingsA ChangeDisplaySettingsExA GetThreadDesktop CloseDesktop SetThreadDesktop OpenInputDesktop SendInput GetAsyncKeyState RegisterHotKey SystemParametersInfoA SetSysColors GetSysColor RedrawWindow PostThreadMessageA UnregisterDeviceNotification RegisterDeviceNotificationA RegisterRawInputDevices GetRawInputData GetMonitorInfoW MonitorFromWindow FindWindowExA GetWindowLongPtrA GetClientRect GetWindowTextA UnhookWinEvent SetWinEventHook GetWindowThreadProcessId IsWindowVisible MessageBoxW MessageBoxA DisplayConfigGetDeviceInfo

gdi32

D3DKMTPollDisplayChildren D3DKMTQueryAdapterInfo DeleteDC CreateDCA SetDeviceGammaRamp

advapi32

RegDeleteKeyA RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA ImpersonateLoggedOnUser RevertToSelf RegDeleteTreeA OpenProcessToken CreateProcessAsUserA ConvertStringSecurityDescriptorToSecurityDescriptorA InitializeSecurityDescriptor RegGetValueW RegGetValueA RegSetValueExW RegDeleteValueA SetSecurityDescriptorDacl RegOpenCurrentUser RegCloseKey

userenv

UnloadUserProfile LoadUserProfileA

wtsapi32

WTSRegisterSessionNotification WTSQuerySessionInformationA WTSFreeMemory WTSEnumerateProcessesA WTSQueryUserToken

powrprof

PowerSetActiveScheme PowerWriteFriendlyName PowerWritePossibleValue PowerWritePossibleFriendlyName PowerWriteACDefaultIndex PowerWriteDCDefaultIndex PowerWriteSettingAttributes PowerRemovePowerSetting PowerCreateSetting PowerCreatePossibleSetting PowerEnumerate PowerReadSettingAttributes PowerWriteACValueIndex PowerWriteDCValueIndex PowerSettingAccessCheck PowerReadACValueIndex PowerReadDCValueIndex PowerGetActiveScheme

setupapi

SetupDiSetDeviceRegistryPropertyA SetupDiDestroyDriverInfoList SetupDiGetDriverInfoDetailA SetupDiEnumDriverInfoA SetupDiBuildDriverInfoList SetupUninstallOEMInfA SetupGetInfDriverStoreLocationA SetupDiGetDeviceInstanceIdA SetupDiSetClassInstallParamsA SetupDiGetHwProfileList SetupDiCallClassInstaller SetupDiOpenDeviceInfoA SetupDiGetDeviceInstallParamsA CM_Get_Parent CM_Locate_DevNodeA CM_Get_Device_IDA CM_Get_Child_Ex SetupDiClassGuidsFromNameA SetupDiGetClassDevsExA CM_Get_DevNode_Status_Ex CM_Get_Device_ID_ExA SetupDiGetDeviceRegistryPropertyA SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiSetDeviceInstallParamsA CM_Reenumerate_DevNode CM_Get_Device_ID_Size CM_Get_DevNode_Status

dwmapi

DwmIsCompositionEnabled ord102

ole32

CoUninitialize PropVariantClear CoInitialize CoCreateInstance CoInitializeEx CoTaskMemFree

difxapi

DriverPackageInstallA DriverPackageUninstallA DriverPackageGetPathA DriverPackagePreinstallA

propsys

InitPropVariantFromDoubleVector

shlwapi

StrStrIA PathStripPathW

newdev

DiInstallDevice

kernel32

GetFileType GetCurrentThread HeapAlloc HeapFree GetModuleHandleExW ExitProcess GetCurrentProcess GetModuleFileNameW WriteFile GetStdHandle WideCharToMultiByte TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer InterlockedFlushSList MultiByteToWideChar GetDateFormatW GetTimeFormatW CompareStringW LoadLibraryExW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleCP GetConsoleMode OutputDebugStringW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW InterlockedPushEntrySList RaiseException RtlPcToFileHeader RtlUnwindEx GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetProcessHeap SetConsoleCtrlHandler GetFileSizeEx SetFilePointerEx CreateFileW ReadFile GetCurrentThreadId WinExec TerminateThread OpenMutexA CreateMutexA ReleaseMutex WaitForMultipleObjects OpenEventA CreateEventA ResetEvent SetEvent GetTickCount VerifyVersionInfoW RemoveDirectoryA FindNextFileA FindFirstFileA FindClose DeleteFileA VerSetConditionMask GetLocalTime FileTimeToSystemTime lstrcmpA LocalAlloc FileTimeToLocalFileTime SetThreadPriority CreateThread QueryPerformanceCounter K32GetModuleBaseNameA K32EnumProcessModules QueryFullProcessImageNameA GetEnvironmentVariableA K32GetProcessImageFileNameA K32EnumProcesses GetSystemDefaultLangID CopyFileA FindResourceExA LockResource LoadResource FreeResource GetSystemDirectoryA SetLastError SetFileAttributesA GetFileTime GetFileAttributesA CreateFileA CreateDirectoryA ReadConsoleW HeapSize HeapReAlloc SetEndOfFile GetCommandLineA ExpandEnvironmentStringsA GetProcAddress LoadLibraryA FreeLibrary GetSystemPowerStatus Process32Next Process32First WriteConsoleW GetLastError Sleep CreateProcessA GetModuleFileNameA CloseHandle MapViewOfFile UnmapViewOfFile AssignProcessToJobObject CreateFileMappingA OpenFileMappingA WaitForSingleObject GetExitCodeProcess OpenProcess IsWow64Process OutputDebugStringA SetInformationJobObject CreateJobObjectA WTSGetActiveConsoleSessionId LocalFree TerminateProcess lstrlenW QueryFullProcessImageNameW CreateToolhelp32Snapshot

shell32

SHGetKnownFolderPath

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

crypt32

CryptDecodeObject CryptQueryObject CertCloseStore CryptMsgGetParam CryptMsgClose

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_c6051ed9fe7ce99de497c00d53613f45_cobalt-strike_icedid_njrat_vidar

user32

gdi32

advapi32

userenv

wtsapi32

powrprof

setupapi

dwmapi

ole32

difxapi

propsys

shlwapi

newdev

kernel32

shell32

version

crypt32

generic