2026-04-11_9c9a375f9d716ce3f97bfeae933ddfc8_cobalt-strike_elex_icedid_njrat_rhadamanthys_stop

Sharing

Copy URL Twitter E-mail

General

Target
2026-04-11_9c9a375f9d716ce3f97bfeae933ddfc8_cobalt-strike_elex_icedid_njrat_rhadamanthys_stop
Size 439KB
Sample260411-p5386sbs8z
SHA256 c3ff38004a5683caf96a4e7d63aa32aab06a0ed44607b34733e0891c78b45971
MD5 9c9a375f9d716ce3f97bfeae933ddfc8
SHA1 7b4a0840037a4bacf7d14aab2f73546fe94a875f
SHA512 aeec207966b9041b700dacefe03db8098fa6165831acdaa2f4869ce0928f6ced98894a3554ac54ccf58b4b69735fd596978c058776f3de281b8c7de2fb09f6bf
SSDEEP 6144:n8TNLO/JiaRGGOAYc5Jq6EmHnMQvSqer5+nDFoy0s:n8p6/oasRuJq6RLer5+nZoyf
TLSH
T1C8A42C0A36A5B8D2DAB29F305D35A6EC673B7892EF10D7772480530E4C762E4CE17B61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-04-11_9c9a375f9d716ce3f97bfeae933ddfc8_cobalt-strike_elex_icedid_njrat_rhadamanthys_stop

File Explorer

2026-04-11_9c9a375f9d716ce3f97bfeae933ddfc8_cobalt-strike_elex_icedid_njrat_rhadamanthys_stop

.exe 439KB

2026-04-11_9c9a375f9d716ce3f97bfeae933ddfc8_cobalt-strike_elex_icedid_njrat_rhadamanthys_stop

IMPHASH c29aa390145c8ce09b0dc56c0ae599ef
SHA256 c3ff38004a5683caf96a4e7d63aa32aab06a0ed44607b34733e0891c78b45971
MD5 9c9a375f9d716ce3f97bfeae933ddfc8
SHA1 7b4a0840037a4bacf7d14aab2f73546fe94a875f
SHA512 aeec207966b9041b700dacefe03db8098fa6165831acdaa2f4869ce0928f6ced98894a3554ac54ccf58b4b69735fd596978c058776f3de281b8c7de2fb09f6bf
SSDEEP 6144:n8TNLO/JiaRGGOAYc5Jq6EmHnMQvSqer5+nDFoy0s:n8p6/oasRuJq6RLer5+nZoyf
TLSH
T1C8A42C0A36A5B8D2DAB29F305D35A6EC673B7892EF10D7772480530E4C762E4CE17B61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7144

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FillConsoleOutputCharacterA GetNumaNodeProcessorMask GetConsoleAliasesLengthW GetDefaultCommConfigW QueryDosDeviceA GetEnvironmentStringsW GetComputerNameW SleepEx ConnectNamedPipe CallNamedPipeW FreeEnvironmentStringsA GetModuleHandleW ReadConsoleOutputA GetCommandLineA GetPriorityClass LoadLibraryW SetSystemTimeAdjustment GetConsoleAliasExesLengthW HeapCreate SetConsoleMode GetFileAttributesW GetModuleFileNameW GetBinaryTypeW SetConsoleTitleA GetStartupInfoA GetLastError GetProcAddress SetStdHandle SearchPathA BuildCommDCBW InterlockedExchangeAdd OpenWaitableTimerW LocalAlloc SetCommMask FoldStringA WaitForMultipleObjects GetModuleHandleA FreeEnvironmentStringsW PurgeComm WaitForDebugEvent GetShortPathNameW SetCalendarInfoA FindAtomW GlobalReAlloc CopyFileExA GetVolumeInformationW CreateFileA HeapFree MultiByteToWideChar HeapAlloc Sleep ExitProcess GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile GetStdHandle GetModuleFileNameA SetHandleCount GetFileType HeapSize LoadLibraryA InitializeCriticalSectionAndSpinCount GetCommandLineW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RtlUnwind LCMapStringA WideCharToMultiByte LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA ReadFile GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW

user32

GetActiveWindow GetUserObjectInformationA

Name

.text

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

996KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

119KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

RAbFuUqf

Size

6KB

Virtual Size

5KB

Characteristics

Name

wehwSbww

Size

512B

Virtual Size

470B

Characteristics

Name

UApnsVQa

Size

33KB

Virtual Size

33KB

Characteristics

Name

VIGBdhyP

Size

512B

Virtual Size

397B

Characteristics

Name

RovoybNv

Size

37KB

Virtual Size

37KB

Characteristics

Name

jlFeXglM

Size

1KB

Virtual Size

1KB

Characteristics

Name

hEpBlhdH

Size

128KB

Virtual Size

128KB

Characteristics

Name

cSVfYVUg

Size

3KB

Virtual Size

3KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

2026-04-11_9c9a375f9d716ce3f97bfeae933ddfc8_cobalt-strike_elex_icedid_njrat_rhadamanthys_stop

kernel32

user32

generic