2026-11-01_8fc58c59f32956305e5a2aa040fb17f1_cobalt-strike_icedid_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_8fc58c59f32956305e5a2aa040fb17f1_cobalt-strike_icedid_vidar
Size 647KB
Sample261102-sc4k1svsfv
SHA256 b0d8fc9d3de42fca4b5ba6ad5d40de11b1d1bbfd70021cfa40ae4fa0051b1490
MD5 8fc58c59f32956305e5a2aa040fb17f1
SHA1 12916aae8d989df1236c2f51d8486cc3f0ab661d
SHA512 cd26945a96dc06d4cd947f65c663c08a1518c990c7b1e1e97f12b5e8b6c093c064ea5fa608267ad28bf72377b5e4a284dc08489fe66e85b8a5370d426812957f
SSDEEP 12288:x7qTURgMsmH5/nAuC71ILYqvw6mqoxo+HNqEvF73CBF+E6U:JqOeILYqvw6JMdkA73CBF+DU
TLSH
T12FE44B3F9BEBB45BC1D78C3DC6AE3F9989B4C8231D22F652B5660C99CA705C01B47861
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-11-01_8fc58c59f32956305e5a2aa040fb17f1_cobalt-strike_icedid_vidar

.exe 647KB

2026-11-01_8fc58c59f32956305e5a2aa040fb17f1_cobalt-strike_icedid_vidar

IMPHASH fd60dddc87379c239e8ac49516966c3e
SHA256 b0d8fc9d3de42fca4b5ba6ad5d40de11b1d1bbfd70021cfa40ae4fa0051b1490
MD5 8fc58c59f32956305e5a2aa040fb17f1
SHA1 12916aae8d989df1236c2f51d8486cc3f0ab661d
SHA512 cd26945a96dc06d4cd947f65c663c08a1518c990c7b1e1e97f12b5e8b6c093c064ea5fa608267ad28bf72377b5e4a284dc08489fe66e85b8a5370d426812957f
SSDEEP 12288:x7qTURgMsmH5/nAuC71ILYqvw6mqoxo+HNqEvF73CBF+E6U:JqOeILYqvw6JMdkA73CBF+DU
TLSH
T12FE44B3F9BEBB45BC1D78C3DC6AE3F9989B4C8231D22F652B5660C99CA705C01B47861
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

4c:50:9c:a4:e7:11:48:f9:20:c5:03:ed:1f:82:1b:1c:67:ff:61:25:dc:2c:ea:4d:7e:cc:f6:28:a9:49:47:a4

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=10036119,CN=BATTLESTATE GAMES LIMITED,O=BATTLESTATE GAMES LIMITED,ST=London\, City of,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Nov 1, 2024

SERIALNUMBER=10036119,CN=BATTLESTATE GAMES LIMITED,O=BATTLESTATE GAMES LIMITED,ST=London\, City of,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=10036119,CN=BATTLESTATE GAMES LIMITED,O=BATTLESTATE GAMES LIMITED,ST=London\, City of,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 15, 2024 - Apr 14, 2035

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

SERIALNUMBER=10036119,CN=BATTLESTATE GAMES LIMITED,O=BATTLESTATE GAMES LIMITED,ST=London\, City of,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

48:d2:30:5a:0e:c2:3e:df:d3:58:36:9f:15:92:2f:03

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 17, 2024 - May 17, 2027

Minor OS version

Major OS version

Entry point

4704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildslave\unity\build\artifacts\WindowsPlayer\Win64_nondev_m_r\WindowsPlayer_Master_mono_x64.pdb

2026-11-01_8fc58c59f32956305e5a2aa040fb17f1_cobalt-strike_icedid_vidar

unityplayer

kernel32

generic