2026-11-09_40e8e03983f9c71a706954d5ece7aaf2_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-09_40e8e03983f9c71a706954d5ece7aaf2_cobalt-strike_icedid_njrat_vidar
Size 3.0MB
Sample261110-1k7xeabe45
SHA256 39039ce86d67f3ec8f81e2a7ccdcf7c6beade2dec78db8f66821f366d981398f
MD5 40e8e03983f9c71a706954d5ece7aaf2
SHA1 a31fc3e3235adb6387b5f681595252a6ef0e1b4d
SHA512 8d413aca2f430a03739f0ef17694d2e6f89a55ae89213455a670535807a4603a978c32ec023424abc828092555263e29840b8c87629df9ac9231dffa4a9b24e0
SSDEEP 49152:DfD0uH569n5JIaz7uaaLr+PdUUCK7t9oN8FfJ4klKXnA:jXM6vSBFfJ4k
TLSH
T19DE58C42F2A322F8F067E238C646522BE7B574482734D3DB43B447A62F53BE0567A359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-09_40e8e03983f9c71a706954d5ece7aaf2_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-11-09_40e8e03983f9c71a706954d5ece7aaf2_cobalt-strike_icedid_njrat_vidar

.exe 3.0MB

2026-11-09_40e8e03983f9c71a706954d5ece7aaf2_cobalt-strike_icedid_njrat_vidar

IMPHASH c882e01a79fc794051a89c026cc69cc6
SHA256 39039ce86d67f3ec8f81e2a7ccdcf7c6beade2dec78db8f66821f366d981398f
MD5 40e8e03983f9c71a706954d5ece7aaf2
SHA1 a31fc3e3235adb6387b5f681595252a6ef0e1b4d
SHA512 8d413aca2f430a03739f0ef17694d2e6f89a55ae89213455a670535807a4603a978c32ec023424abc828092555263e29840b8c87629df9ac9231dffa4a9b24e0
SSDEEP 49152:DfD0uH569n5JIaz7uaaLr+PdUUCK7t9oN8FfJ4klKXnA:jXM6vSBFfJ4k
TLSH
T19DE58C42F2A322F8F067E238C646522BE7B574482734D3DB43B447A62F53BE0567A359
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

163792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType CloseHandle GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleCP GetFileSizeEx MultiByteToWideChar SetLastError GetCurrentThread DeleteFileW GetFileAttributesExW FlushFileBuffers GetTimeZoneInformation WideCharToMultiByte CreateDirectoryW OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap SetConsoleCtrlHandler CreateFileW HeapSize HeapReAlloc SetEndOfFile WriteConsoleW RaiseException RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList RtlUnwind EncodePointer RtlPcToFileHeader WriteFile GetStdHandle GetLastError GetWindowsDirectoryA ReleaseMutex WaitForSingleObject CreateMutexA SetEvent CreateEventA SetConsoleTitleA LocalFree FormatMessageA DeleteFileA FindFirstFileA ReleaseSemaphore GetVersion CreateSemaphoreA OpenProcess SetHandleInformation SetErrorMode GetEnvironmentVariableA GetEnvironmentVariableW GetVersionExA Sleep GetEnvironmentStrings FreeEnvironmentStringsA lstrlenA ResetEvent GetLocalTime CreateFileA SetNamedPipeHandleState SleepEx WaitNamedPipeA FindNextFileA GetSystemWindowsDirectoryA FindFirstFileW GetProcessTimes GetTickCount GetModuleHandleA GetDriveTypeA GetVolumeInformationA DeviceIoControl LoadLibraryExA DuplicateHandle WaitForMultipleObjects SetThreadPriority GetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext GetSystemDirectoryA GetProcessAffinityMask SetProcessAffinityMask SetThreadAffinityMask SetFileTime TzSpecificLocalTimeToSystemTime SystemTimeToFileTime LockFileEx UnlockFileEx CreateThread ExitThread FreeLibraryAndExitThread GetDriveTypeW GetFileInformationByHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime MoveFileExW SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW ReadFile DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleFileNameA LoadLibraryA GetProcAddress GetModuleFileNameW FreeLibrary

shlwapi

PathRemoveFileSpecA PathRemoveBackslashW

user32

GetDlgItemTextW SetFocus GetFocus SendMessageA GetDlgItemTextA SetDlgItemTextA GetDlgItem MessageBoxA GetActiveWindow wsprintfA ShowWindow EndDialog MoveWindow SetWindowTextA GetSystemMetrics CreateDialogIndirectParamA DialogBoxIndirectParamA GetParent GetClientRect GetWindowRect GetWindowLongA MessageBeep ScreenToClient EnableWindow

netapi32

Netbios

comdlg32

GetOpenFileNameA

comctl32

ord17

wsock32

getpeername ioctlsocket inet_addr __WSAFDIsSet closesocket connect WSACleanup WSAStartup getsockname getsockopt htonl getprotobyname WSAGetLastError socket setsockopt send select recv inet_ntoa

shell32

ord680

oleaut32

VariantClear SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound VariantInit SysAllocStringLen SafeArrayGetUBound SafeArrayDestroy SysFreeString SysAllocString

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoUninitialize CoInitializeSecurity

ws2_32

getnameinfo WSAPoll getaddrinfo inet_ntop freeaddrinfo

psapi

GetProcessMemoryInfo

advapi32

RegEnumKeyExA RegQueryInfoKeyA StartServiceA InitializeSecurityDescriptor SetSecurityDescriptorDacl RegCloseKey RegDeleteValueA RegEnumValueA RegOpenKeyExA GetUserNameA GetUserNameW RegQueryValueExA RegQueryValueExW RegSetValueExA RegSetValueExW DeregisterEventSource RegisterEventSourceA ReportEventA RegCreateKeyExA CloseServiceHandle OpenSCManagerA OpenServiceA QueryServiceStatus

dhcpcsvc

DhcpRequestParams

userenv

GetProfilesDirectoryA

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.textidx

Size

940KB

Virtual Size

939KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

333KB

Virtual Size

333KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

556KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

888B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

572KB

Virtual Size

576KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

generic

count=1, id=260, version=27031,

count=138, id=170, productName=VS2010 SP1 build 40219, version=40219,

count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,

count=352, id=224, productName=VS2013 UPD5 build 40629, version=40629,

count=1, id=262, version=26715,

count=31, id=257, version=26715,

count=255, id=1, productName=Unmarked objects,

count=12, id=260, version=26715,

count=9, id=259, version=26715,

count=203, id=261, version=26715,

count=11, id=199, version=41118,

count=39, id=261, version=29118,

count=20, id=260, version=29118,

count=12, id=259, version=29118,

count=5, id=260, productName=VS2019 v16.8.4 build 29336, version=29336,

count=2, id=260, version=24234,

count=1, id=255, productName=VS2019 v16.8.4 build 29336, version=29336,

count=1, id=258, productName=VS2019 v16.8.4 build 29336, version=29336,