2026-07-03_d620ce2af6dfbca8c097a0b36a784a88_akira_cobalt-strike_icedid_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-03_d620ce2af6dfbca8c097a0b36a784a88_akira_cobalt-strike_icedid_satacom_vidar
Size 21.3MB
Sample260703-g6waysht8m
SHA256 71e8d2b63cc34224c0b3a9f7a981a63f9cdcdf70168794f862a84a2bb79ba51d
MD5 d620ce2af6dfbca8c097a0b36a784a88
SHA1 dec12924e209c9dcfeec28fccfdde7cd697499ca
SHA512 391b717a3d0b7b18ead0f50d051361981370ce7b49e6871202118d079b89f6f36178937f63d8c887b35a213d5f1e01c0534a816ca468b1cb1577ecc45cbdf9ec
SSDEEP 393216:A+mpMyh0kHLRWuwEDTGbz2gTxgJUUHgRQgNjftoVGr0Tpl6Zgk0Ih8:UMdyLbGX/uougBOT+Zg1Ie
TLSH
T104373352B14E5C6AE76288709A024733D3767CE6672168EF00903D6C6F7A2E15B3FF58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-03_d620ce2af6dfbca8c097a0b36a784a88_akira_cobalt-strike_icedid_satacom_vidar

.exe 21.3MB

2026-07-03_d620ce2af6dfbca8c097a0b36a784a88_akira_cobalt-strike_icedid_satacom_vidar

IMPHASH 35d3e3f3888cbf765e960b98bdc2948a
SHA256 71e8d2b63cc34224c0b3a9f7a981a63f9cdcdf70168794f862a84a2bb79ba51d
MD5 d620ce2af6dfbca8c097a0b36a784a88
SHA1 dec12924e209c9dcfeec28fccfdde7cd697499ca
SHA512 391b717a3d0b7b18ead0f50d051361981370ce7b49e6871202118d079b89f6f36178937f63d8c887b35a213d5f1e01c0534a816ca468b1cb1577ecc45cbdf9ec
SSDEEP 393216:A+mpMyh0kHLRWuwEDTGbz2gTxgJUUHgRQgNjftoVGr0Tpl6Zgk0Ih8:UMdyLbGX/uougBOT+Zg1Ie
TLSH
T104373352B14E5C6AE76288709A024733D3767CE6672168EF00903D6C6F7A2E15B3FF58
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

45:bd:07:0c:08:12:7e:4c:3f:02:a4:65:43:c0:27:6d:89:f3:aa:b6:59:91:19:80:60:0c:0b:f2:0e:2c:f6:de

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Bayside Computer Systems Inc,O=Bayside Computer Systems Inc,ST=Texas,C=US

Chains

Mar 14, 2025

CN=Bayside Computer Systems Inc,O=Bayside Computer Systems Inc,ST=Texas,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=Bayside Computer Systems Inc,O=Bayside Computer Systems Inc,ST=Texas,C=US

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Serial Number

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Bayside Computer Systems Inc,O=Bayside Computer Systems Inc,ST=Texas,C=US

Serial Number

40:fd:ee:d0:a8:f3:41:ae:64:17:2d:3c:95:c8:ff:91

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 9, 2025 - Jan 9, 2028

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

305976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetConsoleOutputCP FlushFileBuffers HeapSize LCMapStringW GetLastError CompareStringW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee CloseHandle GetModuleHandleW HeapReAlloc AcquireSRWLockExclusive ReleaseSRWLockExclusive VirtualProtect GetCommandLineW InitializeCriticalSectionEx lstrlenW GetProcessId FlsFree GetFileInformationByHandleEx WaitForMultipleObjects GetOverlappedResult WaitForSingleObject GetExitCodeProcess CopyFileExW AcquireSRWLockShared ReleaseSRWLockShared FlsSetValue FlsGetValue FlsAlloc DeleteFileW GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW WideCharToMultiByte GetCPInfo ActivateActCtx GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetCommandLineA GetModuleHandleExW TerminateProcess CreateActCtxW QueryPerformanceCounter Sleep ExitProcess QueryPerformanceFrequency CreateWaitableTimerExW SetWaitableTimer WriteFile GetModuleHandleA GetProcAddress GetCurrentThread TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode RtlPcToFileHeader LoadLibraryExW MultiByteToWideChar WriteConsoleW SetLastError FormatMessageW GetCurrentProcess GetEnvironmentVariableW GetModuleFileNameW CreateFileW GetFileInformationByHandle FreeLibrary GetFullPathNameW CreateDirectoryW FindFirstFileW FindClose GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList GetTempFileNameW GetCurrentProcessId CreateNamedPipeW CreateThread ReadFileEx SleepEx WriteFileEx GetTempPathW CreateEventW CancelIo ReadFile GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry CreateMutexA WaitForSingleObjectEx LoadLibraryA ReleaseMutex RtlVirtualUnwind SetFileInformationByHandle SwitchToThread TlsFree TlsSetValue HeapAlloc TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapFree GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx EncodePointer RaiseException

comctl32

GetWindowSubclass RemoveWindowSubclass SetWindowSubclass DefSubclassProc InitCommonControlsEx

user32

GetParent DeleteMenu GetMenuItemCount DestroyWindow DestroyMenu ReleaseDC GetDC LoadCursorW AdjustWindowRectEx RegisterClassExW ShowWindow CreateWindowExW TranslateMessage DefWindowProcW GetAncestor GetMessageW GetMenuItemID GetSubMenu GetClassNameW AllowSetForegroundWindow SendNotifyMessageW GetClientRect SetParent SendMessageW PostMessageW EnumChildWindows SetWindowPos IsWindow GetMonitorInfoW MonitorFromWindow DispatchMessageW IsDialogMessageW

ole32

CoInitialize CoTaskMemFree CoCreateInstance

gdi32

CreateDIBSection CreateSolidBrush DeleteObject

shell32

SHGetKnownFolderPath DragFinish

shlwapi

SHCreateMemStream

windowscodecs

WICConvertBitmapSource

ntdll

RtlNtStatusToDosError NtReadFile NtCreateFile NtWriteFile

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

Name

.text

Size

355KB

Virtual Size

355KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20.9MB

Virtual Size

20.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-03_d620ce2af6dfbca8c097a0b36a784a88_akira_cobalt-strike_icedid_satacom_vidar

kernel32

comctl32

user32

ole32

gdi32

shell32

shlwapi

windowscodecs

ntdll

bcrypt

advapi32

generic