2026-08-05_129940b34d10ecbf26fccd39a6132557_amadey_cobalt-strike_icedid_njrat_satacom_vidar_wannacry

General

Target
2026-08-05_129940b34d10ecbf26fccd39a6132557_amadey_cobalt-strike_icedid_njrat_satacom_vidar_wannacry
Size 1.1MB
Sample260805-pg2qfafn2w
SHA256 4e8429873a1517b71f96234def80be0cdc2bae03e767490de150b13f68504531
MD5 129940b34d10ecbf26fccd39a6132557
SHA1 ad153a492e13b6d7f4dec2771d81802d014e3544
SHA512 eeaf16df52cdc017ed692afb918ec77f000cdbb5fab410d4a2065cfe4429df271b39666a0975e2af4499a5908b8163bf69c187a4f48d99ebcb7c2d0bfae062df
SSDEEP 24576:rm3NCdBTNsuTYTqMi8CtBd2QHCHmTBW5DG:S3NCLTiqJtb2I
TLSH
T1EF35F655E2A48261D06E9079CB929A45FA333C810BF08ADB12C5F77D5F332D199FA723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-05_129940b34d10ecbf26fccd39a6132557_amadey_cobalt-strike_icedid_njrat_satacom_vidar_wannacry

File Explorer

2026-08-05_129940b34d10ecbf26fccd39a6132557_amadey_cobalt-strike_icedid_njrat_satacom_vidar_wannacry

.exe 1.1MB

2026-08-05_129940b34d10ecbf26fccd39a6132557_amadey_cobalt-strike_icedid_njrat_satacom_vidar_wannacry

IMPHASH 2934d9baf7a3598c9ae9078eada71942
SHA256 4e8429873a1517b71f96234def80be0cdc2bae03e767490de150b13f68504531
MD5 129940b34d10ecbf26fccd39a6132557
SHA1 ad153a492e13b6d7f4dec2771d81802d014e3544
SHA512 eeaf16df52cdc017ed692afb918ec77f000cdbb5fab410d4a2065cfe4429df271b39666a0975e2af4499a5908b8163bf69c187a4f48d99ebcb7c2d0bfae062df
SSDEEP 24576:rm3NCdBTNsuTYTqMi8CtBd2QHCHmTBW5DG:S3NCLTiqJtb2I
TLSH
T1EF35F655E2A48261D06E9079CB929A45FA333C810BF08ADB12C5F77D5F332D199FA723
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

90:0a:82:57:a5:e3:6b:51:78:d8:09:07:f3:ac:f1:e9:d7:c0:c5:43:73:3f:cd:0d:18:15:53:bd:61:09:1f:58

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Chains

Jul 31, 2026

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Serial Number

06:8b:e2:f5:34:52:c8:82:f1:8e:d4:1a:5d:d4:e7:a3

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 19, 2021 - Aug 19, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

43244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u321\2141\build\windows-amd64\jdk\objs\java_objs\java.pdb

advapi32

RegEnumKeyA RegOpenKeyExA RegQueryValueExA RegCloseKey

user32

CharNextExA MessageBoxA

comctl32

InitCommonControlsEx

kernel32

HeapSize WriteConsoleW GetTimeZoneInformation GetCommandLineA CloseHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject GetExitCodeProcess GetExitCodeThread CreateProcessA FreeLibrary GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryA LocalFree FormatMessageA FindClose FindFirstFileA FindNextFileA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetFileSizeEx RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException GetCommandLineW ExitProcess GetModuleHandleExW SetFilePointerEx CreateThread ExitThread FreeLibraryAndExitThread CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetStdHandle WriteFile GetModuleFileNameW ReadFile GetConsoleMode ReadConsoleW HeapAlloc HeapFree CompareStringW LCMapStringW SetStdHandle GetConsoleCP HeapReAlloc MultiByteToWideChar WideCharToMultiByte SetEnvironmentVariableW GetFileAttributesExW FlushFileBuffers GetCurrentDirectoryW GetFullPathNameW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW GetProcessHeap SetEndOfFile

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_129940b34d10ecbf26fccd39a6132557_amadey_cobalt-strike_icedid_njrat_satacom_vidar_wannacry

PE Signature issue

advapi32

user32

comctl32

kernel32

generic