2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar
Size 474KB
Sample261102-zp14zsds41
SHA256 145bc1ecbe458f3128fbcd6f6ce098b54619ed5c62ad80a46af4bb0dfecf30c6
MD5 dc27d3e6b41ba9645a63dbaad3bfddd2
SHA1 28b613e94c42031626d099636257ebe3df213a97
SHA512 0a952339810e3b064d5e38185100e4c81747adedac7681644b45dfc90943c6accbf6e57d5d72b832ee766bfced8b48f1448ca2e1748cf845490bce079a6e97a5
SSDEEP 6144:mOjlZ3taG9h3Hp02Bshx8xZJMIjGI0P2iig1e17nx02tzp4Phl7zLiZr8I:miZ9aG9h372QKYiiOCxpdK6YI
TLSH
T10BA46C5A635408F5D1679239CA53460BE37278045BA1D7CF12A8E3BE2F236D19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar

.exe 474KB

2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar

IMPHASH c2354aac1f805df46f50138ad3089f81
SHA256 145bc1ecbe458f3128fbcd6f6ce098b54619ed5c62ad80a46af4bb0dfecf30c6
MD5 dc27d3e6b41ba9645a63dbaad3bfddd2
SHA1 28b613e94c42031626d099636257ebe3df213a97
SHA512 0a952339810e3b064d5e38185100e4c81747adedac7681644b45dfc90943c6accbf6e57d5d72b832ee766bfced8b48f1448ca2e1748cf845490bce079a6e97a5
SSDEEP 6144:mOjlZ3taG9h3Hp02Bshx8xZJMIjGI0P2iig1e17nx02tzp4Phl7zLiZr8I:miZ9aG9h372QKYiiOCxpdK6YI
TLSH
T10BA46C5A635408F5D1679239CA53460BE37278045BA1D7CF12A8E3BE2F236D19E3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

5e:bb:e3:56:71:6e:75:94:51:d5:5b:d5:e1:c6:66:59:02:cd:58:3e:7f:63:63:4c:7f:43:1d:a4:68:fe:2a:16

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Intel Corporation,OU=Intel pGFX,O=Intel Corporation,POSTALCODE=95054,STREET=2200 Mission College Blvd,L=Santa Clara,ST=CA,C=US

Chains

Dec 13, 2018

CN=Intel Corporation,OU=Intel pGFX,O=Intel Corporation,POSTALCODE=95054,STREET=2200 Mission College Blvd,L=Santa Clara,ST=CA,C=US

Subject

CN=Intel Corporation,OU=Intel pGFX,O=Intel Corporation,POSTALCODE=95054,STREET=2200 Mission College Blvd,L=Santa Clara,ST=CA,C=US

Serial Number

c6:f7:4d:bc:bb:19:08:d4:53:d9:75:05:51:62:ed:d2

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 6, 2018 - Mar 6, 2019

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

33:00:00:00:36:7b:02:ea:cd:06:50:7a:73:00:00:00:00:00:36

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 15, 2013 - Aug 15, 2023

Subject

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Serial Number

69:b2:d1:cc:f0:2e:20:dc:c9:5c:62:89:4f:7f:9e:5f:5f:c0:57:bf

Issuer

CN=QuoVadis Root Certification Authority,OU=Root Certification Authority,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 30, 2014 - Mar 17, 2021

Subject

CN=timestamp.intel.com,OU=Thales TSS ESN:0E37-9649-08C5,O=Intel Corporation,L=Santa Clara,ST=CA,C=US

Serial Number

3c:a5:d5:25:1f:75:29:a5:ba:3c:73:b4:49:6f:a2:c1:b0:c5:6c:9f

Issuer

CN=QuoVadis Issuing CA G4,O=QuoVadis Limited,C=BM

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 20, 2018 - Mar 17, 2021

Minor OS version

Major OS version

Entry point

110320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\qb\workspace\19045\src\p4gen\gfx_Development\dump64\miniport\IntelCpLSPCONSvc\Release\IntelCpHDCPSvc.pdb

cfgmgr32

CM_Get_Device_Interface_List_SizeW CM_Get_Device_Interface_ListW

kernel32

GetCommandLineW CloseHandle HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap EnterCriticalSection LeaveCriticalSection SleepEx GetCurrentProcess GetCurrentThread WriteConsoleW CreateFileW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryExW LoadResource SizeofResource FindResourceW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW SetStdHandle LocalFree lstrcmpiW LCMapStringW MultiByteToWideChar CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedFlushSList GetCurrentThreadId GetCurrentProcessId OutputDebugStringA CreateThread CreateSemaphoreExW ReleaseSemaphore SetEvent InterlockedPushEntrySList InterlockedPopEntrySList DuplicateHandle VirtualFree VirtualProtect VirtualAlloc GetVersionExW GetModuleHandleA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException DecodePointer Sleep CreateEventW WaitForSingleObject QueryPerformanceFrequency QueryPerformanceCounter FindClose GetFileType WriteFile GetStdHandle WaitForMultipleObjects FreeLibraryAndExitThread GetModuleHandleExW ExitProcess RtlPcToFileHeader GetThreadTimes RtlUnwindEx TryEnterCriticalSection SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount WideCharToMultiByte WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait EncodePointer LoadLibraryW

advapi32

DeleteService OpenThreadToken CopySid ConvertStringSecurityDescriptorToSecurityDescriptorW EventUnregister EventRegister NotifyServiceStatusChangeW StartServiceCtrlDispatcherW EventWrite SetServiceStatus RegisterServiceCtrlHandlerExW QueryServiceConfigW OpenServiceW OpenSCManagerW GetLengthSid CreateServiceW ControlService CloseServiceHandle ChangeServiceConfigW RegSetValueExW RegSetValueExA RegQueryValueExW RegQueryValueExA RegQueryInfoKeyW RegOpenKeyExW RegOpenKeyW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey SetSecurityDescriptorOwner SetSecurityDescriptorGroup MakeAbsoluteSD IsValidSid InitializeSecurityDescriptor GetTokenInformation GetSecurityDescriptorLength OpenProcessToken

user32

MessageBoxW CharNextW CharUpperW PostThreadMessageW DispatchMessageW TranslateMessage GetMessageW LoadStringW

oleaut32

VariantClear VariantInit SafeArrayCopy SafeArrayUnlock LoadRegTypeLi SafeArrayLock SafeArrayGetLBound SafeArrayGetVartype SafeArrayGetUBound SysFreeString SafeArrayRedim SafeArrayDestroy SafeArrayCreate UnRegisterTypeLi RegisterTypeLi LoadTypeLi VarUI4FromStr SysStringLen SysAllocString

api-ms-win-dx-d3dkmt-l1-1-0

D3DKMTCreateDevice D3DKMTOpenAdapterFromGdiDisplayName D3DKMTOpenAdapterFromDeviceName D3DKMTCloseAdapter D3DKMTDestroyDevice D3DKMTEscape

ole32

CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2 CoReleaseServerProcess CoAddRefServerProcess CoResumeClassObjects CoRevokeClassObject CoRegisterClassObject CoUninitialize CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance

api-ms-win-ntuser-sysparams-l1-1-0

EnumDisplayDevicesW

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-02_dc27d3e6b41ba9645a63dbaad3bfddd2_cobalt-strike_icedid_njrat_vidar

PE Signature issue

cfgmgr32

kernel32

advapi32

user32

oleaut32

api-ms-win-dx-d3dkmt-l1-1-0

ole32

api-ms-win-ntuser-sysparams-l1-1-0

generic