2026-06-27_a31259495a3bf76175d79c2046c551bd_cobalt-strike_coinminer_elex_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_a31259495a3bf76175d79c2046c551bd_cobalt-strike_coinminer_elex_icedid_njrat_vidar
Size 1.8MB
Sample260629-e14c9ses6k
SHA256 ac32767fbb529958eb15ef4cb25870691d5d9f867c03c2e4a2715d9a72eff754
MD5 a31259495a3bf76175d79c2046c551bd
SHA1 fffb8f01dbdc6a0d426a978b66121f7cd8348c61
SHA512 a8290a63fa16662c668b2ceb729b7f234d09c90a5802fff4593394056ce4e26e369f329e7a218a6f54bf1ddbc7702447654d392ed3c62eedf0ea5aefaad67621
SSDEEP 49152:1sNBk9/fw2BwfmM0fPoJdXN0BMOwLloBrugP5ta1LR:1sNi9XwgwfoIJdXN0B7+st5ta1t
TLSH
T1E2858D16F2505472D23A4130CB557315B17BB8311AF2A24BB3D8EB3D2FF15D299AAB23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-27_a31259495a3bf76175d79c2046c551bd_cobalt-strike_coinminer_elex_icedid_njrat_vidar

File Explorer

2026-06-27_a31259495a3bf76175d79c2046c551bd_cobalt-strike_coinminer_elex_icedid_njrat_vidar

.exe 1.8MB

2026-06-27_a31259495a3bf76175d79c2046c551bd_cobalt-strike_coinminer_elex_icedid_njrat_vidar

SHA256 ac32767fbb529958eb15ef4cb25870691d5d9f867c03c2e4a2715d9a72eff754
MD5 a31259495a3bf76175d79c2046c551bd
SHA1 fffb8f01dbdc6a0d426a978b66121f7cd8348c61
SHA512 a8290a63fa16662c668b2ceb729b7f234d09c90a5802fff4593394056ce4e26e369f329e7a218a6f54bf1ddbc7702447654d392ed3c62eedf0ea5aefaad67621
SSDEEP 49152:1sNBk9/fw2BwfmM0fPoJdXN0BMOwLloBrugP5ta1LR:1sNi9XwgwfoIJdXN0B7+st5ta1t
TLSH
T1E2858D16F2505472D23A4130CB557315B17BB8311AF2A24BB3D8EB3D2FF15D299AAB23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

5d:af:4f:ec:74:e0:f2:66:4f:02:2f:b7:ac:0b:54:20:23:cb:5e:b6:68:be:04:61:50:5e:36:62:59:f3:28:92

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 25, 2026

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

4e:8d:44:86:53:d9:b4:19:a9:ce:ae:aa:47:d3:1b:a9:34:d3:bc:0f

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 13, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9a:9a:9b:16:c2:83:da:d5:c2:00:00:00:00:00:9a

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7AFA-E41C-E142,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:84:93:8a:42:8f:2c:7c:23:e8:00:00:00:00:00:84

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 30, 2016 - Jun 30, 2017

Minor OS version

Major OS version

Entry point

591876

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Office\Target\x86\ship\postc2r\x-none\msqry32.pdb

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_a31259495a3bf76175d79c2046c551bd_cobalt-strike_coinminer_elex_icedid_njrat_vidar

PE Signature issue

PE Signature issue

generic