ducktail | 2026-08-23_0ff83d84ecbe7405641564c553427b46_cobalt-strike_coinminer_glassworm_hijackloader_icedid_krakenkeylogger_njrat_olympic-destroyer_poet-rat_quasar-rat_satacom_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-23_0ff83d84ecbe7405641564c553427b46_cobalt-strike_coinminer_glassworm_hijackloader_icedid_krakenkeylogger_njrat_olympic-destroyer_poet-rat_quasar-rat_satacom_vidar
Size 71.7MB
Sample260824-vp83daap51
SHA256 68a465322a0b1d931cd37ca5c48ccf87bcddea374441dd33ce3ad89d78913463
MD5 0ff83d84ecbe7405641564c553427b46
SHA1 fc102c115e2ee4ae6485b58b719a7aaba5a72775
SHA512 7f3ff912ba44b884cd84a7d3db7f793f473f1716b8f5160cb4e444fc6ca9ad5aaf8dc2049d075e3a7de268f67704aa18069eda3b182db639d680543225320959
SSDEEP 393216:0E5le7IKmkgrpdZXrVzG9SdRkLwjy1CcdCl0WUtHXxOK4jdbA1sZRwLP64lg/f58:0Q/HMKC8gBs8z64HQUpsMgNRa5Pj2z+
TLSH
T141F7AE15E3E80766E0BFD239C6639512C6B0B4962772D7CF1404E6992D57BE32B3A233
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

revoked_codesign stealer ducktail

Malware Config

Signatures

Family: Ducktail
Ducktail is a single file deployment stealer written in C#.
stealer ducktail

Detect Ducktail Third Stage Payload 1 IoCs

resource	yara_rule
sample	ducktail_3rd_stage

Custom signature

Detects encrypted or obfuscated .NET executables 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_DotNET_Encrypted

Custom signature

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
2026-08-23_0ff83d84ecbe7405641564c553427b46_cobalt-strike_coinminer_glassworm_hijackloader_icedid_krakenkeylogger_njrat_olympic-destroyer_poet-rat_quasar-rat_satacom_vidar

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-23_0ff83d84ecbe7405641564c553427b46_cobalt-strike_coinminer_glassworm_hijackloader_icedid_krakenkeylogger_njrat_olympic-destroyer_poet-rat_quasar-rat_satacom_vidar

File Explorer

2026-08-23_0ff83d84ecbe7405641564c553427b46_cobalt-strike_coinminer_glassworm_hijackloader_icedid_krakenkeylogger_njrat_olympic-destroyer_poet-rat_quasar-rat_satacom_vidar

.exe 71.7MB

2026-08-23_0ff83d84ecbe7405641564c553427b46_cobalt-strike_coinminer_glassworm_hijackloader_icedid_krakenkeylogger_njrat_olympic-destroyer_poet-rat_quasar-rat_satacom_vidar

IMPHASH 21c545b801a2a9bdada8a6dcb7cc0fc3
SHA256 68a465322a0b1d931cd37ca5c48ccf87bcddea374441dd33ce3ad89d78913463
MD5 0ff83d84ecbe7405641564c553427b46
SHA1 fc102c115e2ee4ae6485b58b719a7aaba5a72775
SHA512 7f3ff912ba44b884cd84a7d3db7f793f473f1716b8f5160cb4e444fc6ca9ad5aaf8dc2049d075e3a7de268f67704aa18069eda3b182db639d680543225320959
SSDEEP 393216:0E5le7IKmkgrpdZXrVzG9SdRkLwjy1CcdCl0WUtHXxOK4jdbA1sZRwLP64lg/f58:0Q/HMKC8gBs8z64HQUpsMgNRa5Pj2z+
TLSH
T141F7AE15E3E80766E0BFD239C6639512C6B0B4962772D7CF1404E6992D57BE32B3A233
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detect Ducktail Third Stage Payload
Detects encrypted or obfuscated .NET executables
Detects executables containing SQL queries to confidential data stores. Observed in infostealers
Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

6e:c3:ee:c2:2d:eb:99:42:c2:2d:c3:23:ac:79:9d:54:37:e0:74:7d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=1801627080,CN=CONG TY TNHH DICH VU TU VAN THIEN SON,OU=IT Department,O=CONG TY TNHH DICH VU TU VAN THIEN SON,STREET=111 Bui Van Hoanh\, Khu vuc 2\, Phuong An Khanh\, Quan Ninh Kieu,L=Can Tho,ST=Can Tho,C=VN,1.3.6.1.4.1.311.60.2.1.2=#130743616e2054686f,1.3.6.1.4.1.311.60.2.1.3=#1302564e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 14, 2023

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Serial Number

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 21, 2022 - Nov 21, 2033

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

3c:0a:8b:5c:97:6d:36:9b:33:a9:6d:f4

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Apr 3, 2023

Timespan

Mar 8, 2023 - Mar 8, 2024

Minor OS version

Major OS version

Entry point

267600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\static\Release\singlefilehost.pdb

kernel32

FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection GetEnvironmentVariableW GetTempPathW FindClose CreateFileW MultiByteToWideChar GetLastError GetFileAttributesExW LoadLibraryA CloseHandle GetCurrentDirectoryW GetProcAddress DeleteCriticalSection WideCharToMultiByte CreateFileMappingW MapViewOfFile IsWow64Process LoadLibraryExW RemoveDirectoryW Sleep GetCurrentProcessId UnmapViewOfFile InitializeCriticalSectionAndSpinCount SetEvent GetFullPathNameW WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary EnterCriticalSection FindFirstFileExW GetFileSizeEx CreateDirectoryW GetModuleHandleW OutputDebugStringW ResetEvent GetStringTypeW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx TryEnterCriticalSection GetExitCodeThread DecodePointer LCMapStringEx

advapi32

RegCloseKey RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegOpenKeyExW

user32

MessageBoxW

shell32

ShellExecuteW

api-ms-win-crt-runtime-l1-1-0

_initterm _get_initial_wide_environment _invalid_parameter_noinfo_noreturn _configure_wide_argv _initterm_e _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table abort exit _register_thread_local_exe_atexit_callback _c_exit __p___wargv _wcserror _errno __p___argc _initialize_wide_environment _exit _beginthreadex terminate

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func fwrite _set_fmode fclose fputc fgetc __stdio_common_vsprintf_s fseek _wfsopen fgetpos setvbuf _wfopen __stdio_common_vswprintf __stdio_common_vfwprintf fflush fputws fputwc ungetc fsetpos fread _fseeki64 _get_stream_buffer_pointers __p__commode

api-ms-win-crt-heap-l1-1-0

_callnewh realloc malloc free calloc _set_new_mode

api-ms-win-crt-string-l1-1-0

__strncnt _wcsicmp _wcsdup _wcsnicmp wcsncmp strcspn islower towlower strcpy_s isupper wcsnlen

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-locale-l1-1-0

localeconv _lock_locales _unlock_locales setlocale _configthreadlocale __pctype_func ___mb_cur_max_func ___lc_locale_name_func ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf frexp

api-ms-win-crt-time-l1-1-0

_time64 wcsftime _gmtime64

api-ms-win-crt-filesystem-l1-1-0

_wrename _unlock_file _lock_file _wremove

Name

.text

Size

294KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_0ff83d84ecbe7405641564c553427b46_cobalt-strike_coinminer_glassworm_hijackloader_icedid_krakenkeylogger_njrat_olympic-destroyer_poet-rat_quasar-rat_satacom_vidar

PE Signature issue

kernel32

advapi32

user32

shell32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic