2026-09-23_74ae0836ce63327260f56c44d408b618_amadey_cobalt-strike_icedid_njrat_vidar_wannacry

General

Target
2026-09-23_74ae0836ce63327260f56c44d408b618_amadey_cobalt-strike_icedid_njrat_vidar_wannacry
Size 743KB
Sample260924-g5vm2azdnd
SHA256 3ba358db0661b3fd10d38f4ab2927d4ba1f89af6ce194df5ee6702dcecdc1f65
MD5 74ae0836ce63327260f56c44d408b618
SHA1 39bfc0632eae0a07b502b520f0ce1fb2508e0da8
SHA512 60aed07993e5266dccd9fa19eef0a0f87dd2b47c901a29f14d05873c9ce67301ed09078d0571d322962ac031b3d049a6c1efe80e469ce36041db37c7bf6e72c0
SSDEEP 12288:uXAm3ggRUeMz9TNXvk3aJ1gL5pRTcAkS/3hzN8qE43fm78V:rm3NCdBTNs3a45jcAkSYqyE
TLSH
T1F2F44B15F6748675D073C07AC9D2AA4AEA7234450730CACF139AA7782F377E2893A771
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-23_74ae0836ce63327260f56c44d408b618_amadey_cobalt-strike_icedid_njrat_vidar_wannacry

File Explorer

2026-09-23_74ae0836ce63327260f56c44d408b618_amadey_cobalt-strike_icedid_njrat_vidar_wannacry

.exe 743KB

2026-09-23_74ae0836ce63327260f56c44d408b618_amadey_cobalt-strike_icedid_njrat_vidar_wannacry

IMPHASH 2934d9baf7a3598c9ae9078eada71942
SHA256 3ba358db0661b3fd10d38f4ab2927d4ba1f89af6ce194df5ee6702dcecdc1f65
MD5 74ae0836ce63327260f56c44d408b618
SHA1 39bfc0632eae0a07b502b520f0ce1fb2508e0da8
SHA512 60aed07993e5266dccd9fa19eef0a0f87dd2b47c901a29f14d05873c9ce67301ed09078d0571d322962ac031b3d049a6c1efe80e469ce36041db37c7bf6e72c0
SSDEEP 12288:uXAm3ggRUeMz9TNXvk3aJ1gL5pRTcAkS/3hzN8qE43fm78V:rm3NCdBTNs3a45jcAkSYqyE
TLSH
T1F2F44B15F6748675D073C07AC9D2AA4AEA7234450730CACF139AA7782F377E2893A771
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

18:a2:6e:ec:b9:9a:f7:0b:31:b3:29:f5:a8:f1:5a:18:c4:e8:a3:ae:dc:11:db:db:f7:c9:a1:60:d9:3f:fe:3f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Chains

Sep 23, 2026

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Serial Number

06:8b:e2:f5:34:52:c8:82:f1:8e:d4:1a:5d:d4:e7:a3

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 19, 2021 - Aug 19, 2023

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

6

Entry point

43244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\jenkins\workspace\8-2-build-windows-amd64-cygwin\jdk8u321\2141\build\windows-amd64\jdk\objs\java_objs\java.pdb

advapi32

RegEnumKeyA RegOpenKeyExA RegQueryValueExA RegCloseKey

user32

CharNextExA MessageBoxA

comctl32

InitCommonControlsEx

kernel32

HeapSize WriteConsoleW GetTimeZoneInformation GetCommandLineA CloseHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject GetExitCodeProcess GetExitCodeThread CreateProcessA FreeLibrary GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryA LocalFree FormatMessageA FindClose FindFirstFileA FindNextFileA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetFileSizeEx RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW RaiseException GetCommandLineW ExitProcess GetModuleHandleExW SetFilePointerEx CreateThread ExitThread FreeLibraryAndExitThread CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetStdHandle WriteFile GetModuleFileNameW ReadFile GetConsoleMode ReadConsoleW HeapAlloc HeapFree CompareStringW LCMapStringW SetStdHandle GetConsoleCP HeapReAlloc MultiByteToWideChar WideCharToMultiByte SetEnvironmentVariableW GetFileAttributesExW FlushFileBuffers GetCurrentDirectoryW GetFullPathNameW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW GetProcessHeap SetEndOfFile

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-23_74ae0836ce63327260f56c44d408b618_amadey_cobalt-strike_icedid_njrat_vidar_wannacry

PE Signature issue

advapi32

user32

comctl32

kernel32

generic