2026-09-10_f135fabda546b2b0652e0880355223ab_cobalt-strike_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_f135fabda546b2b0652e0880355223ab_cobalt-strike_icedid_njrat_vidar
Size 299KB
Sample260910-kt4y4stwat
SHA256 7cf4786bf0f5d96cfea85fd3fc4796acc15a0b88f267fca43975d27a6430e6f0
MD5 f135fabda546b2b0652e0880355223ab
SHA1 6d1447143f09e71960714a5be360b86a74810236
SHA512 670761028a6c04922d1e30239e4bb996785599a7743c622fccffe786e6086321cac41c88a2267cac957bf9fe0c41d87d1b9179cfd8f308ba6660da5ee6198b8c
SSDEEP 6144:dcaQfyCbP4+tfsEDA50IjBGCNgeusZCy5rGGk:+P48fsEDAaI4QGaNk
TLSH
T131641946BBE918F0E8B6C1398992221AF9727C624770D7CB52906E5B5F33BD0AD3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
2026-09-10_f135fabda546b2b0652e0880355223ab_cobalt-strike_icedid_njrat_vidar

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-10_f135fabda546b2b0652e0880355223ab_cobalt-strike_icedid_njrat_vidar

File Explorer

2026-09-10_f135fabda546b2b0652e0880355223ab_cobalt-strike_icedid_njrat_vidar

.exe 299KB

2026-09-10_f135fabda546b2b0652e0880355223ab_cobalt-strike_icedid_njrat_vidar

IMPHASH ad9d3fb95cbac8980218b759a91b7e62
SHA256 7cf4786bf0f5d96cfea85fd3fc4796acc15a0b88f267fca43975d27a6430e6f0
MD5 f135fabda546b2b0652e0880355223ab
SHA1 6d1447143f09e71960714a5be360b86a74810236
SHA512 670761028a6c04922d1e30239e4bb996785599a7743c622fccffe786e6086321cac41c88a2267cac957bf9fe0c41d87d1b9179cfd8f308ba6660da5ee6198b8c
SSDEEP 6144:dcaQfyCbP4+tfsEDA50IjBGCNgeusZCy5rGGk:+P48fsEDAaI4QGaNk
TLSH
T131641946BBE918F0E8B6C1398992221AF9727C624770D7CB52906E5B5F33BD0AD3D740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

83:94:a6:46:4e:d6:11:eb:bc:4a:97:fd:ce:8b:cf:4a:86:18:71:72:fe:76:17:f7:22:72:96:7f:37:a6:a2:54

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=11303620,CN=Ionik Software Ltd,O=Ionik Software Ltd,L=London,ST=England,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Nov 17, 2024

SERIALNUMBER=11303620,CN=Ionik Software Ltd,O=Ionik Software Ltd,L=London,ST=England,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Subject

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

56:b6:29:cd:34:bc:78:f6

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2017 - May 30, 2042

Subject

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

Issuer

CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 26, 2019 - Mar 22, 2034

Subject

SERIALNUMBER=11303620,CN=Ionik Software Ltd,O=Ionik Software Ltd,L=London,ST=England,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

20:00:a8:c1:3f:c2:2c:78:da:32:ef:ec:5e:b1:ac:61

Issuer

CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Aug 13, 2024

Timespan

Aug 13, 2024 - Aug 6, 2025

Subject

CN=SSL.com Timestamping Unit 2024 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

5a:5a:ac:e8:1a:35:6e:b4:62:86:8d:57:7d:e0:3d:c7

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2024 - Feb 16, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

72280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetFilePointer InitializeCriticalSectionEx GetCurrentThreadId HeapSize MultiByteToWideChar Sleep GetLastError LockResource HeapReAlloc CloseHandle RaiseException CreateThread FindResourceExW LoadResource FindResourceW HeapAlloc DecodePointer HeapDestroy GetProcAddress DeleteCriticalSection ExitProcess GetProcessHeap GetModuleHandleW LeaveCriticalSection WideCharToMultiByte SetConsoleOutputCP GetFileType lstrcmpiW LoadLibraryExW FlushFileBuffers CreateFileW GetConsoleMode SetFilePointerEx GetStringTypeW SetStdHandle LCMapStringW FlsFree GetModuleFileNameW ExpandEnvironmentStringsW WriteFile GetConsoleOutputCP EnterCriticalSection SetLastError HeapFree SizeofResource FreeLibrary ReadFile FlsSetValue FlsGetValue FlsAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetStdHandle WriteConsoleW GetModuleHandleExW GetCommandLineW GetCommandLineA RtlUnwind TlsFree TlsSetValue TlsGetValue TlsAlloc RtlPcToFileHeader RtlUnwindEx EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache VirtualAlloc VirtualFree LoadLibraryExA IsDebuggerPresent OutputDebugStringW InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime

user32

SetWindowLongPtrW LoadCursorW TranslateMessage CharNextW PeekMessageW DispatchMessageW RegisterClassExW GetWindowLongPtrW MsgWaitForMultipleObjects UnregisterClassW CreateWindowExW DefWindowProcW CallWindowProcW MessageBoxW GetClassInfoExW

advapi32

RegCloseKey RegQueryInfoKeyW RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW

ole32

CoInitialize CoTaskMemAlloc StringFromGUID2 CoGetObject CoCreateInstance CLSIDFromProgID CoTaskMemFree CoTaskMemRealloc CLSIDFromString CoGetInstanceFromFile CoUninitialize

oleaut32

LoadRegTypeLi VariantInit LoadTypeLi SysFreeString SysAllocString VariantCopy SysStringLen SafeArrayUnaccessData SysAllocStringLen LoadTypeLibEx VariantChangeType VariantClear VarUI4FromStr SafeArrayAccessData

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_f135fabda546b2b0652e0880355223ab_cobalt-strike_icedid_njrat_vidar

PE Signature issue

kernel32

user32

advapi32

ole32

oleaut32

generic