2026-10-26_f723cfc0d40a099ce1b94d7f9a76c24f_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar

General

Target
2026-10-26_f723cfc0d40a099ce1b94d7f9a76c24f_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar
Size 572KB
Sample261027-cap2vaxw8n
SHA256 c5266cf2126b4629d219d2bc0759bfe9ed11c1c4fb62e53d99849218534dbbd1
MD5 f723cfc0d40a099ce1b94d7f9a76c24f
SHA1 cd17e207f9631d425588b7ac134211a3d34e30e7
SHA512 ee1f23051fed6bbd50dd5d2372054c0a55b28966a4bddf532bfcb8b57de12bb7294b3fcac2dde3d4e6d244998fddafb7f0261c6e0a73b6a366eeb95cda636821
SSDEEP 12288:swfq7i0Ch0AZjMfQqu9qnQU44vIvgTsoFmoc/aal/7:br0ChdiHAvgTsoFmK4/7
TLSH
T1B9C47E25A3A842F4F1A7E138C5954516F7B1784A23619ACF53B04AAB2F276F05F3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-10-26_f723cfc0d40a099ce1b94d7f9a76c24f_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar

File Explorer

2026-10-26_f723cfc0d40a099ce1b94d7f9a76c24f_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar

.exe 572KB

2026-10-26_f723cfc0d40a099ce1b94d7f9a76c24f_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar

IMPHASH 4f264e7f524a6e3664ca53a0cb06d44e
SHA256 c5266cf2126b4629d219d2bc0759bfe9ed11c1c4fb62e53d99849218534dbbd1
MD5 f723cfc0d40a099ce1b94d7f9a76c24f
SHA1 cd17e207f9631d425588b7ac134211a3d34e30e7
SHA512 ee1f23051fed6bbd50dd5d2372054c0a55b28966a4bddf532bfcb8b57de12bb7294b3fcac2dde3d4e6d244998fddafb7f0261c6e0a73b6a366eeb95cda636821
SSDEEP 12288:swfq7i0Ch0AZjMfQqu9qnQU44vIvgTsoFmoc/aal/7:br0ChdiHAvgTsoFmK4/7
TLSH
T1B9C47E25A3A842F4F1A7E138C5954516F7B1784A23619ACF53B04AAB2F276F05F3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

bf:c2:6e:b4:5a:bd:81:93:78:ed:c2:9d:2c:0a:06:75:68:44:c6:d6:93:e5:fc:d1:bf:72:17:f4:f6:35:a4:d9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=h3g2L5.projects.google.com

Chains

Mar 25, 2025

CN=h3g2L5.projects.google.com

Subject

CN=h3g2L5.projects.google.com

Serial Number

60:2f:6b:f9:f4:98:ca:99:4f:be:89:df:56:60:fb:43

Issuer

CN=h3g2L5.projects.google.com

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 25, 2025 - Mar 25, 2026

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

249496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\work\__chrome_ex_install\__my_src\src\_Release\mi_nt_svc.pdb

kernel32

HeapReAlloc HeapAlloc DecodePointer DeleteCriticalSection GetProcessHeap GetFileSizeEx FindNextFileW TerminateProcess GetModuleFileNameW FindClose CreateFileW FileTimeToSystemTime HeapFree GetSystemTime GetExitCodeProcess TerminateThread HeapSize WriteConsoleW SetEndOfFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW CreateDirectoryA K32EnumProcessModules CreateProcessW GetProcAddress CloseHandle Process32FirstW DeleteFileA Process32NextW GetLastError K32GetModuleFileNameExA GetTempPathA Sleep MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess SetStdHandle CreateThread InitializeCriticalSectionEx GetTimeZoneInformation CreatePipe GetFileAttributesExW ReadConsoleW WaitForSingleObject SystemTimeToFileTime GetStringTypeW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection EncodePointer GetLocaleInfoEx LCMapStringEx CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW RaiseException RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW DuplicateHandle GetFileType ReadFile ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW RtlUnwind

advapi32

RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW

shell32

ShellExecuteExW

crypt32

CryptQueryObject CertCloseStore CertFindCertificateInStore CertFreeCertificateContext

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_f723cfc0d40a099ce1b94d7f9a76c24f_cobalt-strike_icedid_njrat_qakbot_satacom_stealc_vidar

PE Signature issue

kernel32

advapi32

shell32

crypt32

generic