2026-08-08_950208129d017b03ea76fc4f3437dfb0_cobalt-strike_hijackloader_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_950208129d017b03ea76fc4f3437dfb0_cobalt-strike_hijackloader_icedid_njrat_vidar
Size 574KB
Sample260808-2n5f5awbla
SHA256 6c614adddf97b2e44fda648e86fb26c1a8d47579ab0dc514a92594e236c96278
MD5 950208129d017b03ea76fc4f3437dfb0
SHA1 a7af069cb314f94f26e38631ed368c1d5546eb52
SHA512 16ad99d556d3fada8868978c46baa8a39594f7d29d2a7da126ebf05c6186396b8a8f4fec0d986a9f73925979d4f14d41fca423ac13672d65241eb58a4cae2e11
SSDEEP 6144:HTJ4fjVARc63B8zXThNi+JA+QcBPkR4c/cOTQ44XJKe7oV75rz:mfpARck8nhNJAEB8R4Qc+z
TLSH
T104C4A0037E9408A5D86A727DB852F4F597616C330BDF85CA12633F1ABA32FB14B25631
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-08_950208129d017b03ea76fc4f3437dfb0_cobalt-strike_hijackloader_icedid_njrat_vidar

File Explorer

2026-08-08_950208129d017b03ea76fc4f3437dfb0_cobalt-strike_hijackloader_icedid_njrat_vidar

.exe 574KB

2026-08-08_950208129d017b03ea76fc4f3437dfb0_cobalt-strike_hijackloader_icedid_njrat_vidar

IMPHASH 0efc3f1527d1456a62be853c26fd808d
SHA256 6c614adddf97b2e44fda648e86fb26c1a8d47579ab0dc514a92594e236c96278
MD5 950208129d017b03ea76fc4f3437dfb0
SHA1 a7af069cb314f94f26e38631ed368c1d5546eb52
SHA512 16ad99d556d3fada8868978c46baa8a39594f7d29d2a7da126ebf05c6186396b8a8f4fec0d986a9f73925979d4f14d41fca423ac13672d65241eb58a4cae2e11
SSDEEP 6144:HTJ4fjVARc63B8zXThNi+JA+QcBPkR4c/cOTQ44XJKe7oV75rz:mfpARck8nhNJAEB8R4Qc+z
TLSH
T104C4A0037E9408A5D86A727DB852F4F597616C330BDF85CA12633F1ABA32FB14B25631
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

21:b3:24:b0:7e:68:1b:fc:09:65:57:ee:a4:6e:00:1e:ec:12:34:79:97:48:fa:c2:ff:24:ed:da:51:55:a9:21

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=DBeaver Corp,O=DBeaver Corp,L=New York,ST=New York,C=US

Chains

Sep 9, 2024

CN=DBeaver Corp,O=DBeaver Corp,L=New York,ST=New York,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DBeaver Corp,O=DBeaver Corp,L=New York,ST=New York,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DBeaver Corp,O=DBeaver Corp,L=New York,ST=New York,C=US

Serial Number

0f:79:6c:01:e8:2f:d5:bf:29:95:af:fe:a7:cd:a2:6d

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 18, 2024 - Jul 17, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Minor OS version

Major OS version

Entry point

23812

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FindClose FindFirstFileW FindNextFileW WideCharToMultiByte FreeLibrary GetModuleHandleW GetProcAddress MultiByteToWideChar LoadLibraryW WriteConsoleW SetEndOfFile ReadConsoleW ReadFile HeapSize GetTimeZoneInformation LoadLibraryExW GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetDriveTypeW GetFullPathNameW CreateFileW GetFileInformationByHandle GetFileType CloseHandle PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetCurrentDirectoryW SetStdHandle HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx VirtualAlloc

user32

MessageBoxW CreateWindowExW SetClassLongPtrW LoadIconW

Name

.text

Size

163KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

50KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

288KB

Virtual Size

292KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_950208129d017b03ea76fc4f3437dfb0_cobalt-strike_hijackloader_icedid_njrat_vidar

PE Signature issue

kernel32

user32

generic