2026-05-30_c2303d4c32b823c422c7d5c2832789ab_cobalt-strike_icedid_rhadamanthys_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-30_c2303d4c32b823c422c7d5c2832789ab_cobalt-strike_icedid_rhadamanthys_satacom_vidar
Size 301KB
Sample260530-pgvbcsdz6k
SHA256 d6e77357d30ab33494d2e11486364f306f15924ef254e3741f344fcbb2dbea06
MD5 c2303d4c32b823c422c7d5c2832789ab
SHA1 8d64d37de1f8dd541be688bbe1d0f28bcd000dad
SHA512 fec3f6ce06e79688e44f509a6d6a07181b552b08a156d5ae54c3cba863b40d78553b93bfbfa024ed85da5e17bfba995d1aa75ec9ac9e338395cff77d79bbf5e8
SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YHiYV0OZNjrc1F+QU:C540UVwleMITTmNv1ohWsqkiuW1FXEF
TLSH
T14E644C6935F800F2D175C1B48BD08A67F235F87627208DFB8390875A5E23A916D7BF29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-30_c2303d4c32b823c422c7d5c2832789ab_cobalt-strike_icedid_rhadamanthys_satacom_vidar

File Explorer

2026-05-30_c2303d4c32b823c422c7d5c2832789ab_cobalt-strike_icedid_rhadamanthys_satacom_vidar

.exe 301KB

2026-05-30_c2303d4c32b823c422c7d5c2832789ab_cobalt-strike_icedid_rhadamanthys_satacom_vidar

IMPHASH 9af6910bc05e23c793bc38f5603df9f1
SHA256 d6e77357d30ab33494d2e11486364f306f15924ef254e3741f344fcbb2dbea06
MD5 c2303d4c32b823c422c7d5c2832789ab
SHA1 8d64d37de1f8dd541be688bbe1d0f28bcd000dad
SHA512 fec3f6ce06e79688e44f509a6d6a07181b552b08a156d5ae54c3cba863b40d78553b93bfbfa024ed85da5e17bfba995d1aa75ec9ac9e338395cff77d79bbf5e8
SSDEEP 3072:C5EvMBXEV0tle+5IbvBCMmNginHy8lZoY46Mu/rLogrlKq9YHiYV0OZNjrc1F+QU:C540UVwleMITTmNv1ohWsqkiuW1FXEF
TLSH
T14E644C6935F800F2D175C1B48BD08A67F235F87627208DFB8390875A5E23A916D7BF29
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

ef:a3:17:39:f0:70:8e:7f:1a:19:df:32:e4:6d:78:66:13:ee:96:ec:f1:ee:cd:65:a4:8e:1f:f2:5c:f1:d5:8d

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 30, 2023

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:3e:63:3a:86:bf:41:73:d7:e0:00:00:00:00:03:3e

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 16, 2023 - Jan 31, 2024

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:b1:ca:90:43:ee:0b:f0:03:ab:00:01:00:00:01:b1

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 20, 2022 - Dec 14, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

23984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MicrosoftEdgeUpdateComRegisterShell64_unsigned.pdb

kernel32

GetCommandLineW DecodePointer RaiseException GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount DeleteCriticalSection FindResourceExW GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW GetShortPathNameW GetModuleFileNameW CloseHandle VirtualQuery LoadLibraryExW LocalFree SetLastError FindNextFileW GetCurrentProcess GetEnvironmentVariableW FindClose LoadLibraryW FreeLibrary lstrcmpiW GetTickCount lstrlenW MultiByteToWideChar WideCharToMultiByte WriteFile GetPrivateProfileIntW OutputDebugStringA CreateFileW GetCurrentThreadId Sleep OutputDebugStringW GetCurrentProcessId TerminateProcess WaitForSingleObjectEx GetFileAttributesExW GetSystemTimeAsFileTime FlushFileBuffers TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSection CreateEventW SetEvent ResetEvent ExitProcess IsDebuggerPresent GetModuleHandleExW GetStdHandle GlobalAlloc GlobalFree GlobalLock GlobalUnlock RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead GetStartupInfoW InitializeCriticalSectionEx EncodePointer GetStringTypeW GetCPInfo RtlUnwindEx RtlPcToFileHeader TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemInfo VirtualProtect LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx GetConsoleOutputCP GetConsoleMode WriteConsoleW LoadLibraryExA

Name

.text

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-30_c2303d4c32b823c422c7d5c2832789ab_cobalt-strike_icedid_rhadamanthys_satacom_vidar

PE Signature issue

kernel32

generic