2026-06-27_770f131493039a310ae9b5b6e7154669_cobalt-strike_coinminer_elex_hijackloader_icedid_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_770f131493039a310ae9b5b6e7154669_cobalt-strike_coinminer_elex_hijackloader_icedid_vidar
Size 2.0MB
Sample260629-gp8vqaet2z
SHA256 1cd96b29b2904c63bb16be4b692dad091d36d066668e8dcf2bba90bc4653af22
MD5 770f131493039a310ae9b5b6e7154669
SHA1 61ade62c5e58ce525ca2a557e9a856691569db9a
SHA512 5cf023cc98571ecf5ca6ac177e9a349c1b4582269eebbf54e045f8d2a092d77f5d486e90c8e8ba8dff51c300c2d147548124e5ebc873a8910d0d9595fef26cf7
SSDEEP 49152:1sNBk9/fw2BwfmM0fPoJdXN0BMOwLloBrug1IAOj:1sNi9XwgwfoIJdXN0B7+s+
TLSH
T146A56C26F16050B1D2795134CB57A214B167EC3007A1A28FB6D8EF3D3BB26D1E9BA713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-27_770f131493039a310ae9b5b6e7154669_cobalt-strike_coinminer_elex_hijackloader_icedid_vidar

File Explorer

2026-06-27_770f131493039a310ae9b5b6e7154669_cobalt-strike_coinminer_elex_hijackloader_icedid_vidar

.exe 2.0MB

2026-06-27_770f131493039a310ae9b5b6e7154669_cobalt-strike_coinminer_elex_hijackloader_icedid_vidar

SHA256 1cd96b29b2904c63bb16be4b692dad091d36d066668e8dcf2bba90bc4653af22
MD5 770f131493039a310ae9b5b6e7154669
SHA1 61ade62c5e58ce525ca2a557e9a856691569db9a
SHA512 5cf023cc98571ecf5ca6ac177e9a349c1b4582269eebbf54e045f8d2a092d77f5d486e90c8e8ba8dff51c300c2d147548124e5ebc873a8910d0d9595fef26cf7
SSDEEP 49152:1sNBk9/fw2BwfmM0fPoJdXN0BMOwLloBrug1IAOj:1sNi9XwgwfoIJdXN0B7+s+
TLSH
T146A56C26F16050B1D2795134CB57A214B167EC3007A1A28FB6D8EF3D3BB26D1E9BA713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

76:ff:5b:38:b9:f9:37:8f:cd:ca:09:1b:41:4e:0a:0a:72:cb:b1:79:51:30:f9:d1:7f:31:18:b9:98:35:55:19

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 25, 2026

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

d9:35:74:ae:3a:7e:e9:f0:7b:68:3b:9a:59:e5:44:a7:a3:43:b1:92

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 13, 2016

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B1B7-F67F-FEC2,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:9a:9a:9b:16:c2:83:da:d5:c2:00:00:00:00:00:9a

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 30, 2016 - Jun 30, 2017

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 4, 2015 - Sep 4, 2016

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 28, 2015 - Jan 28, 2017

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7AFA-E41C-E142,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:84:93:8a:42:8f:2c:7c:23:e8:00:00:00:00:00:84

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 30, 2016 - Jun 30, 2017

Minor OS version

Major OS version

Entry point

591876

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Office\Target\x86\ship\postc2r\x-none\msqry32.pdb

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_770f131493039a310ae9b5b6e7154669_cobalt-strike_coinminer_elex_hijackloader_icedid_vidar

PE Signature issue

PE Signature issue

generic