2026-10-26_8091f67f6b77fbe7193e608ee8fe8424_cobalt-strike_icedid_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_8091f67f6b77fbe7193e608ee8fe8424_cobalt-strike_icedid_vidar
Size 317KB
Sample261027-qlnj2sdf53
SHA256 bcb7d6285c60bd95caa72c662961974d97638c4db038b4ee588133942b048997
MD5 8091f67f6b77fbe7193e608ee8fe8424
SHA1 4b3c09276283767232a0911669cca74991afe3cf
SHA512 fee67f3db19cb96b13e83da3800cb91d05ad77f334d1a4d4aead491fa4b31d8da3f397e32aff9560274e8aaf633aaf7b8f9362e29ecb0f2f75b8bf717516b0be
SSDEEP 6144:2tC0dmW5LrcE6jDi2xQvHxtfMFlNEfk4BQOwaKb2r2OxmQJykulGp:2gAt5L/6XiJzkFl+kjRbejLJye
TLSH
T1DA64E07467EC9CE5E072447880B19744E73AFC20067ADF2F862471E65FB62C16D2BB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-26_8091f67f6b77fbe7193e608ee8fe8424_cobalt-strike_icedid_vidar

.exe 317KB

2026-10-26_8091f67f6b77fbe7193e608ee8fe8424_cobalt-strike_icedid_vidar

IMPHASH 0848262455b8f707b8174922f3614dbc
SHA256 bcb7d6285c60bd95caa72c662961974d97638c4db038b4ee588133942b048997
MD5 8091f67f6b77fbe7193e608ee8fe8424
SHA1 4b3c09276283767232a0911669cca74991afe3cf
SHA512 fee67f3db19cb96b13e83da3800cb91d05ad77f334d1a4d4aead491fa4b31d8da3f397e32aff9560274e8aaf633aaf7b8f9362e29ecb0f2f75b8bf717516b0be
SSDEEP 6144:2tC0dmW5LrcE6jDi2xQvHxtfMFlNEfk4BQOwaKb2r2OxmQJykulGp:2gAt5L/6XiJzkFl+kjRbejLJye
TLSH
T1DA64E07467EC9CE5E072447880B19744E73AFC20067ADF2F862471E65FB62C16D2BB62
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

50:7c:1b:b2:5f:f0:79:63:30:9c:35:cc:80:2b:0c:5a:a9:b3:be:e9:e4:51:9e:78:e7:41:9c:b0:a9:5f:c3:e2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=SQUARE ENIX CO.\, LTD.,O=SQUARE ENIX CO.\, LTD.,L=Shinjuku-ku,ST=Tokyo,C=JP

Chains

Feb 11, 2026

CN=SQUARE ENIX CO.\, LTD.,O=SQUARE ENIX CO.\, LTD.,L=Shinjuku-ku,ST=Tokyo,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=SQUARE ENIX CO.\, LTD.,O=SQUARE ENIX CO.\, LTD.,L=Shinjuku-ku,ST=Tokyo,C=JP

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=SQUARE ENIX CO.\, LTD.,O=SQUARE ENIX CO.\, LTD.,L=Shinjuku-ku,ST=Tokyo,C=JP

Serial Number

08:d0:5a:37:7e:50:13:0d:39:5e:a5:8d:a3:19:04:d8

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 1, 2023 - Apr 30, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

6684

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

BootstrapPackagedGame-Win64-Shipping.pdb

kernel32

GetFileAttributesW CloseHandle GetLastError WaitForSingleObject GetExitCodeProcess CreateProcessW GetModuleFileNameW LoadResource LockResource SizeofResource LoadLibraryW FindResourceW WriteConsoleW CreateFileW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW LCMapStringW GetProcessHeap HeapSize

user32

wsprintfW MessageBoxW

shell32

ShellExecuteExW

shlwapi

PathCombineW PathRemoveFileSpecW PathCanonicalizeW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_8091f67f6b77fbe7193e608ee8fe8424_cobalt-strike_icedid_vidar

kernel32

user32

shell32

shlwapi

generic