2026-07-21_c7b51d5478eab1cc10c361da59b2c26d_cobalt-strike_icedid_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-21_c7b51d5478eab1cc10c361da59b2c26d_cobalt-strike_icedid_satacom_vidar
Size 108KB
Sample260721-eetxpsd18l
SHA256 4238ddcc184c4f0d11d99c2f8ef8e6a511ac829eaeecefd8300399936ec640bf
MD5 c7b51d5478eab1cc10c361da59b2c26d
SHA1 8d799b1fdf66944274c96b0cf89f4e81c1a9693c
SHA512 aa08e2ed83bbd91c591b9c7c1a252a407606be06093b8945c6f14f13fad970ae0ced8a0f3e9f27f218aee2bf2baa93551958e9f9623f3467d3bc41075cab3996
SSDEEP 3072:jfL+72PsK9Qd/RpgyxMkJfjQmMCdwMzTVfiHWPTc:jCqkK2/Rp5DzTV4+c
TLSH
T14EB37C9B63E530F9E5328634C8A04A0AE771F9721661CF6F02A446561F273D29E3EF71
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-21_c7b51d5478eab1cc10c361da59b2c26d_cobalt-strike_icedid_satacom_vidar

.exe 108KB

2026-07-21_c7b51d5478eab1cc10c361da59b2c26d_cobalt-strike_icedid_satacom_vidar

IMPHASH f06e1d8fe48a24e57f945e564f9be716
SHA256 4238ddcc184c4f0d11d99c2f8ef8e6a511ac829eaeecefd8300399936ec640bf
MD5 c7b51d5478eab1cc10c361da59b2c26d
SHA1 8d799b1fdf66944274c96b0cf89f4e81c1a9693c
SHA512 aa08e2ed83bbd91c591b9c7c1a252a407606be06093b8945c6f14f13fad970ae0ced8a0f3e9f27f218aee2bf2baa93551958e9f9623f3467d3bc41075cab3996
SSDEEP 3072:jfL+72PsK9Qd/RpgyxMkJfjQmMCdwMzTVfiHWPTc:jCqkK2/Rp5DzTV4+c
TLSH
T14EB37C9B63E530F9E5328634C8A04A0AE771F9721661CF6F02A446561F273D29E3EF71
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

92:ba:db:2d:dd:db:86:ed:f6:50:fc:cb:71:69:5d:7c:46:4a:20:df:65:e5:25:bd:e1:64:99:a8:56:3b:5b:34

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,L=New York,ST=New York,C=US

Chains

Jul 19, 2026

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,L=New York,ST=New York,C=US

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Reason Cybersecurity Inc.,O=Reason Cybersecurity Inc.,L=New York,ST=New York,C=US

Serial Number

33:00:03:4a:e6:35:8e:a3:39:f9:21:4f:c6:00:00:00:03:4a:e6

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 18, 2026 - Jul 21, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7800-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:57:24:d3:95:e0:a2:e9:c9:31:00:00:00:00:00:57

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

4768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Workspace\_Reason\rsLitmus\x64\Release\rsLitmus.pdb

Name

.text

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-07-21_c7b51d5478eab1cc10c361da59b2c26d_cobalt-strike_icedid_satacom_vidar

kernel32

generic