2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar

General

Target
2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar
Size 3.2MB
Sample261102-fwrdkseb48
SHA256 56076f6f28fb9257a0ee3b8b1b0efe2c9b02aee51a1fed787bdbc76f52831107
MD5 e597da691ce78af7c18eb59ea6c2aae7
SHA1 cbabcd8cc0fa070270e9c790cb9e8a4eb345cbd0
SHA512 977d7cb777ff0c70d1f76de55cc05598a8b3113a4c09172108e84b538ab699eb67946c2097c55aaffa61ace99012a0ef28df1f9d016df31b828b58fad92f2713
SSDEEP 49152:GGtlq2d/Y4yXkvcW5pkK4/YLTDy7+GHVBK7B9TSEoQqQTacZ+p1fDWjzQgilV99B:SXkJNBfTUw+pgjI
TLSH
T13DF58D0EA76840E8E5A7D17989468646F3F278555B729BCF02A0476E2F737F04E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar

File Explorer

2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar

.exe 3.2MB

2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar

IMPHASH c3a457ff30931ecd939f3a6c0c1aa4c3
SHA256 56076f6f28fb9257a0ee3b8b1b0efe2c9b02aee51a1fed787bdbc76f52831107
MD5 e597da691ce78af7c18eb59ea6c2aae7
SHA1 cbabcd8cc0fa070270e9c790cb9e8a4eb345cbd0
SHA512 977d7cb777ff0c70d1f76de55cc05598a8b3113a4c09172108e84b538ab699eb67946c2097c55aaffa61ace99012a0ef28df1f9d016df31b828b58fad92f2713
SSDEEP 49152:GGtlq2d/Y4yXkvcW5pkK4/YLTDy7+GHVBK7B9TSEoQqQTacZ+p1fDWjzQgilV99B:SXkJNBfTUw+pgjI
TLSH
T13DF58D0EA76840E8E5A7D17989468646F3F278555B729BCF02A0476E2F737F04E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

553444

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\jenkins\workspace\exman-corelib\release-8.5\win64\AdobeExtensionsService\BinX64\Win\Release\AdobeExtensionsService.pdb

kernel32

DeleteFileW FindClose FindFirstFileW FindNextFileW FlushFileBuffers GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFullPathNameW LockFileEx RemoveDirectoryW SetEndOfFile SetFilePointerEx UnlockFile GetTempPathW DuplicateHandle CreateNamedPipeW GetNamedPipeInfo SetEvent ResetEvent WaitForSingleObject CreateMutexW CreateEventW WaitForMultipleObjects SetThreadPriority GetThreadPriority TlsAlloc TlsGetValue TlsSetValue VirtualAlloc VirtualFree CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameW GetModuleHandleExW LoadLibraryExW CopyFileW FormatMessageW LocalAlloc LocalReAlloc LocalFree GetTickCount CreateFileW Sleep GetCurrentThread GetCurrentThreadId InitializeCriticalSection DeleteCriticalSection GetSystemTimeAsFileTime GetCommandLineW FreeEnvironmentStringsW SetFileAttributesW TerminateProcess GetStartupInfoW GetExitCodeThread TlsFree InitializeCriticalSectionAndSpinCount TryEnterCriticalSection GetSystemInfo GetComputerNameA GetTimeZoneInformation QueryPerformanceFrequency WriteConsoleW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW GetConsoleMode GetConsoleCP RtlUnwind EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW CompareStringW FreeLibraryAndExitThread ExitThread CreateThread ExitProcess SetLastError InterlockedPushEntrySList CreateDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW SetEnvironmentVariableW GetEnvironmentStringsW SetStdHandle LeaveCriticalSection EnterCriticalSection SetFilePointer LCMapStringW GetLocalTime RtlCaptureStackBackTrace GetOverlappedResult ConnectNamedPipe ReadFile SwitchToThread GetModuleHandleW GetLastError WriteFile GetFileType GetEnvironmentVariableW GetStdHandle RtlVirtualUnwind LoadLibraryA GetProcAddress FreeLibrary OpenProcess GetCurrentProcessId MoveFileExW WideCharToMultiByte GetCurrentProcess CloseHandle OutputDebugStringW RtlUnwindEx RtlPcToFileHeader AreFileApisANSI HeapCreate RaiseException MultiByteToWideChar FormatMessageA InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent WaitForSingleObjectEx InitializeSListHead IsDebuggerPresent QueryPerformanceCounter GetSystemTime SystemTimeToFileTime GetProcessHeap GetFileSize CreateFileMappingA HeapDestroy HeapCompact HeapAlloc LoadLibraryW HeapReAlloc DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnlockFileEx GetFullPathNameA LockFile OutputDebugStringA GetDiskFreeSpaceW HeapFree

user32

SetWindowLongPtrW GetWindowLongPtrW MsgWaitForMultipleObjectsEx RegisterClassW PeekMessageW LoadIconW LoadCursorW FindWindowW EndPaint BeginPaint TranslateAcceleratorW LoadAcceleratorsW EndDialog DialogBoxParamW CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW DispatchMessageW TranslateMessage GetMessageW LoadStringW PostMessageW DestroyWindow

advapi32

SetNamedSecurityInfoW CreateWellKnownSid GetUserNameW SetSecurityDescriptorDacl SetSecurityDescriptorControl InitializeSecurityDescriptor GetTokenInformation OpenProcessToken

shell32

CommandLineToArgvW

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

652KB

Virtual Size

652KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

66KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

584KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_e597da691ce78af7c18eb59ea6c2aae7_amadey_cobalt-strike_icedid_njrat_stealc_vidar

kernel32

user32

advapi32

shell32

generic