2026-05-29_f6812fb9f8ff97c7d085f3e07d8e32d9_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-29_f6812fb9f8ff97c7d085f3e07d8e32d9_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar
Size 1000KB
Sample260529-d64esact5x
SHA256 9164554677c5dc6f9c5063d033e869c341e22f04fec4574d0f123c41ccdf1f71
MD5 f6812fb9f8ff97c7d085f3e07d8e32d9
SHA1 3ef3243c0bc3fcf3a2f2b1a0e3ef32c8a57d1e3c
SHA512 00ba924df70995de6a1cf9de6b4751da32358428f63938909f9aff8170d1c57c45c457d3346e3e69334c6b13b51d7a08a0267c2f212bf113e23a3715c0bb149b
SSDEEP 24576:20m7MVyppWwUeY/vnS5QhJfgtwy+dFA0z:aMwEeY//IQhJowy+T
TLSH
T1E3258D1BF69500ECD029C574CB668132DA72B8970B34AAEF06D1D2591E7BAF46F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-29_f6812fb9f8ff97c7d085f3e07d8e32d9_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar

File Explorer

2026-05-29_f6812fb9f8ff97c7d085f3e07d8e32d9_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar

.exe 1000KB

2026-05-29_f6812fb9f8ff97c7d085f3e07d8e32d9_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar

IMPHASH f00313248336a406014dae280ab69396
SHA256 9164554677c5dc6f9c5063d033e869c341e22f04fec4574d0f123c41ccdf1f71
MD5 f6812fb9f8ff97c7d085f3e07d8e32d9
SHA1 3ef3243c0bc3fcf3a2f2b1a0e3ef32c8a57d1e3c
SHA512 00ba924df70995de6a1cf9de6b4751da32358428f63938909f9aff8170d1c57c45c457d3346e3e69334c6b13b51d7a08a0267c2f212bf113e23a3715c0bb149b
SSDEEP 24576:20m7MVyppWwUeY/vnS5QhJfgtwy+dFA0z:aMwEeY//IQhJowy+T
TLSH
T1E3258D1BF69500ECD029C574CB668132DA72B8970B34AAEF06D1D2591E7BAF46F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

36:06:37:f7:f7:56:35:ff:6b:5f:8f:da:77:27:f0:e0:c5:cf:50:68:90:48:f4:14:44:5a:cb:b1:48:fa:e6:3f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 20, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 15, 2020 - Dec 2, 2021

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:E041-4BEE-FA7E,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:37:41:8f:43:e7:5a:5b:6f:a7:00:00:00:00:01:37

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2020 - Jan 12, 2022

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

Major OS version

Entry point

370992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

identity_helper.exe.pdb

msedge_elf

GetInstallDetailsPayload SignalInitializeCrashReporting

advapi32

EventRegister EventUnregister EventWrite RegCloseKey RegGetValueW RegOpenKeyExW RegQueryValueExW SystemFunction036

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateEventW CreateFileMappingW CreateFileW CreateThread DeleteCriticalSection DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetFileAttributesW GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadId GetThreadPriority GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW GetWindowsDirectoryW InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ResetEvent RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetProcessShutdownParameters SetStdHandle SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UnmapViewOfFile UnregisterWaitEx VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath

ole32

CoCreateInstance CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoTaskMemFree CoUninitialize

winmm

timeGetTime

oleaut32

SysAllocString SysAllocStringLen SysFreeString VariantClear

user32

PostMessageW

Name

.text

Size

782KB

Virtual Size

782KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

153KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

289B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-29_f6812fb9f8ff97c7d085f3e07d8e32d9_akira_cobalt-strike_icedid_mespinoza_njrat_ryuk_satacom_vidar

PE Signature issue

msedge_elf

advapi32

kernel32

shell32

ole32

winmm

oleaut32

user32

generic