2026-05-18_bf5649a0be5bdb65af059ea3f3fcfb2a_cobalt-strike_elex_hijackloader_icedid_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-18_bf5649a0be5bdb65af059ea3f3fcfb2a_cobalt-strike_elex_hijackloader_icedid_vidar
Size 1.6MB
Sample260518-tk8elsfz21
SHA256 d9bb096643edd7ca1b8e9007924dc841de47a390862c87c8c87ba041a8a007fa
MD5 bf5649a0be5bdb65af059ea3f3fcfb2a
SHA1 40ab6315d298a11200d9cfc9b02ccd4e83caa1ab
SHA512 668ec71094c54feab476a07af9530e0222eb11868035be0c976bff74a2279d062d9a0039b4258412986c45df5317803c0149453f6cd897419ad57b501a9d936a
SSDEEP 24576:SuvFtss86TYCsDL1D5mSjMIgekHD5TvinrmjxD0wlOjwG:SuvFtss1Tw1doIgekj56rgIAOj
TLSH
T1C3750862A1F95A90D6AF28348853A631E233BD010F164BDFB65C7F2A79332D1B53D217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-18_bf5649a0be5bdb65af059ea3f3fcfb2a_cobalt-strike_elex_hijackloader_icedid_vidar

File Explorer

2026-05-18_bf5649a0be5bdb65af059ea3f3fcfb2a_cobalt-strike_elex_hijackloader_icedid_vidar

.exe 1.6MB

2026-05-18_bf5649a0be5bdb65af059ea3f3fcfb2a_cobalt-strike_elex_hijackloader_icedid_vidar

IMPHASH 8e382beb8f618c29dede8f29725989ad
SHA256 d9bb096643edd7ca1b8e9007924dc841de47a390862c87c8c87ba041a8a007fa
MD5 bf5649a0be5bdb65af059ea3f3fcfb2a
SHA1 40ab6315d298a11200d9cfc9b02ccd4e83caa1ab
SHA512 668ec71094c54feab476a07af9530e0222eb11868035be0c976bff74a2279d062d9a0039b4258412986c45df5317803c0149453f6cd897419ad57b501a9d936a
SSDEEP 24576:SuvFtss86TYCsDL1D5mSjMIgekHD5TvinrmjxD0wlOjwG:SuvFtss1Tw1doIgekj56rgIAOj
TLSH
T1C3750862A1F95A90D6AF28348853A631E233BD010F164BDFB65C7F2A79332D1B53D217
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

4d:05:9d:bc:74:91:16:8d:cc:33:31:e9:16:c9:c0:a3:28:ee:29:52

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 27, 2006

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 4, 2006 - Apr 26, 2012

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:46:9e:cb:00:04:00:00:00:65

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 4, 2006 - Oct 4, 2007

Minor OS version

Major OS version

Entry point

24369

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

t:\onenote\x86\ship\0\onelev.pdb

kernel32

lstrlenW RaiseException InitializeCriticalSection DeleteCriticalSection GetLastError CloseHandle WaitForSingleObject GetModuleFileNameW Sleep EnterCriticalSection LeaveCriticalSection GetModuleHandleW GetCurrentThreadId CreateThread CreateEventW SetEvent GetCommandLineW LoadLibraryA FreeLibrary LocalAlloc HeapSize HeapReAlloc HeapDestroy GetVersionExA SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoA InterlockedCompareExchange InterlockedExchange LoadLibraryW HeapAlloc HeapFree GetTempPathA GetTempFileNameA CreateProcessA GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualProtect GetACP GetLocaleInfoA GetThreadLocale IsDebuggerPresent

user32

DispatchMessageW TranslateMessage CharUpperW CharNextW UnregisterClassA GetMessageW PostThreadMessageW

msvcr80

_cexit _XcptFilter _ismbblead exit _acmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode _encode_pointer __set_app_type _except_handler4_common ?terminate@@YAXXZ _unlock __dllonexit _lock _onexit _decode_pointer _crt_debugger_hook _invoke_watson _controlfp_s ?_type_info_dtor_internal_method@type_info@@QAEXXZ __getmainargs _amsg_exit fopen_s fwprintf_s fclose vsprintf_s vswprintf_s wcsrchr memset calloc memmove_s memcpy_s malloc realloc ??2@YAPAXI@Z __CxxFrameHandler3 ??_U@YAPAXI@Z ??_V@YAXPAX@Z wcscat_s wcsncpy_s wcscpy_s _CxxThrowException free ??3@YAXPAX@Z _exit

netapi32

NetShareAdd

secur32

GetUserNameExW

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-18_bf5649a0be5bdb65af059ea3f3fcfb2a_cobalt-strike_elex_hijackloader_icedid_vidar

PE Signature issue

kernel32

user32

msvcr80

netapi32

secur32

generic