2026-04-15_ea86d4b91562cd0d16a23cee76e1234e_cloudeye_cobalt-strike_elex_icedid_njrat_xloader

resource
2026-04-15_ea86d4b91562cd0d16a23cee76e1234e_cloudeye_cobalt-strike_elex_icedid_njrat_xloader

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 11268d6d8c82d4ca8dca1ff16851814053c6aafd16f3e94a0c919c305fc614a0
MD5 ea86d4b91562cd0d16a23cee76e1234e
SHA1 89e118bae3f1a90f2dd917685ca1d3e49e9e484b
SHA512 72f04485664067846712db29e1626cb89943be128f436477937d8e4e65610e06ec08a0e776358a803eed00319a6a77561273474b9ff1fc9d64430991e8b6b1b9
SSDEEP 12288:gYfoGhymsmK2myS6iYmaDU+pEDF2USlzsh+W9xbse2eXInPe+lJ8s0Rn8er5+nZo:gYfoGBsmEL6EaDu4pU19VVh95Q
TLSH
T10CE4E00D7AA4D8D6D8324F309C34C5A56736BCA32D125B6B2AC4634E6D372B4DF1AB34
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

Name

.text

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

551KB

Virtual Size

550KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

pbAsMCKL

Size

112KB

Virtual Size

112KB

Characteristics

Name

EyRvUwMZ

Size

3KB

Virtual Size

2KB

Characteristics

.data

SHA256 f05daf3c91cc357d04794a740f21eaaeb870f250877e3a6dc498c5c3046cb414
MD5 4b2421975c21b032f7ea000f5e7f9fbf
SHA1 f45486287d474fdcafc99c24e37c4eb61bf613b3
SHA512 45b9cc616c42014c0429c4b66e47f186d707cf9319ae7afeb824f71a52014a2fe63ae33ad8299b4a9be04ab00a5fe53353edb44485bc6eeefbe01f67037269c1
TLSH
T14E314310B3E9820DF2F31BB52D7985260BBA7CA1DDB0E35C0280941E2872A1599F8737
MD5 SHA1 SHA512 TLSH

.rdata

SHA256 95df72950424a97746c83c619f9aa736879b408a87751927b5d41994e8183a9c
MD5 8c5edfd8ff9cc0135e197611be38ca18
SHA1 dc4f14d019cad6646b38852dfb7370532acafebc
SHA512 91d614f4e21a5c3a970ea842b97267565b04085b90c67b1f3305210c4af38ab136c876d193c7eab19d509fa58314a01bb9017c7c45daf2740c31c510e29b2498
SSDEEP 96:hqGrMl8xCavqvIdvqEJdlTnDPhxyPYPkcmkJqiy0BjKwrY:lrLDdzFnDLyPYyk8UjKG
TLSH
T1B5B1A9C52ABC098BD9E25F30747A1E0F8DF85407202F630825C8E29EFF9D492955A7E3
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/DIALOG/105

SHA256 fecdb955f8d7f1c219ff8167f90b64f3cb52e53337494577ff73c0ac1dafcd96
MD5 3409f314895161597f3c395cc5f65525
SHA1 1a99d016d65e567f24449d9362afb6ac44006d0b
SHA512 f3e7394fa49325a7ea46728b77a5e819e18d63049d54c6adf36d08619709484f8bbd20206416d3c1440bd70632d99d9a45f3488482353f90aa21aa6ee3915427
TLSH
T106D00218A3A6CA1BE429DA7DAAE3C3A71432F8045816450BB986F30F5970A91FE59D41
MD5 SHA1 SHA512 TLSH

.rsrc/DIALOG/106

SHA256 69897c784f1491eb3024b0d52c2897196a2e245974497fda1915db5fefcf8729
MD5 2d12c45dc2c029044aaff357141cb900
SHA1 083db861ab3c7db23c6257878296e73a89a74b8b
SHA512 a50dcf605a914f0a6f94b3f815be159c2b729d005a25d6cc9120c4d34445cae2d0b20df3dbdc7672f316010c6a47079265548a1ed5a523896963b1a3ddf98a17
TLSH
T168D0224846E0C408F4365C3894B1CAF22A1478490D00A58BBDE813AB4020C00FAF7202
MD5 SHA1 SHA512 TLSH

.rsrc/DIALOG/111

SHA256 85025c8556952f6a651c2468c8a0d58853b0ba482be9ad5cd3060f216540dfc0
MD5 6be4e1387d369cf86e68eacbdd0e81dd
SHA1 351970fe2681b9b35b5d59ad052011ed96a96e17
SHA512 b81b287de73282cc5a7337559fbce5af01d1a440f04ee97c6a8e1de0c787ef38936c951b802014b841fc517fe7f2b916266dc8c35cd5de1ad0c630dc2218fa81
TLSH
T1C4B002A043B9C10FE5155972BE7AD5B65111F80054345A0BBB64634F1810DC5CF49287
MD5 SHA1 SHA512 TLSH

.rsrc/GROUP_ICON/103

SHA256 773e01435ecfab6630c70a5b9402e8bda2d93c44a3801542be483ecac691f74a
MD5 b8eb201efb4d37b462fa9ac8580ffdff
SHA1 446f833e048653c0501b2b6aece002e139015afd
SHA512 8fa861d341757f6ceb2dd0d046500d4aa5125a00d178c4a9762ca0ad69d6a4b121779f8708e1071132756a50167636a2fd6636b3504393391f583fcfcea2e5fc
TLSH
T109C092955F106E1EE2C002FC00AB8B6B463CD8D672528A42965F08503E436996C7CB12
MD5 SHA1 SHA512 TLSH

.rsrc/ICON/1

SHA256 d553c08f07d629bdfc154b3a4c7ca25df4483f027adc8c03f81bc714164f66a2
MD5 604e40b67374e294c09babf6886a4bf5
SHA1 ab29a5a86f1c60f8626cd2e8203f18278939b071
SHA512 1d52be10aa0d09ce9450846ec76533aed4c10bc2cdae6897dc507d2da8bdbbe1e1e0af3154941ddf695375b5b073ef209c5df1f10f1db83d1804786dbe269ac3
SSDEEP 6144:paoGDtyj028b5ie/KVUxz0y7u6tTbAYthP2aE2jUxMpEDF2USlsJ8sh+Wk:AoGhymsmK2myS6iYmaDU+pEDF2USlzsk
TLSH
T1B964234A9860ABD89D0643389170F8BC6A1D95623C2B357D8B4FC3FB3799745638F392
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/ICON/10.ico

SHA256 b1fe1b41c838ca52fb49eca0f9e941ef011d5679cde746117990518e2a88c8a2
MD5 39907e360995480606e05f33644c304f
SHA1 194cdd0836e46cf7c675be29757cf42ae5935906
SHA512 cdca4f4b66f8601f710e23aa3e259454f0d7e28cc326d337ae027985eece85395f618d9e3a7d6f372cb3a5bad7b9ae572fb88568b47bf93fc1db7f3a564bbc93
TLSH
T120212388E9D56F82C68CD6B4C8E3116004B88B296C2C296695211FFB0D3571EB12A949
MD5 SHA1 SHA512 TLSH

.rsrc/ICON/2

SHA256 257666fae0a870bab0f120a4c1f3da812525338af93e0ee1bd0a25afd575562d
MD5 6fa7fc7d122e1ef15423d6b42a1ea2dc
SHA1 f709a2a743acbd74d1e20bbdd82456305030db89
SHA512 f572e8d70cf56129fc66f1a9f1a58020351596cd73127015b74fa466aebfd1d265b38f4eebd093a666d28ed8ae80d19f46876026e5f5ae3cc9b6a0d5911c1ac5
SSDEEP 1536:XWVfrMEkx8bMLRjsHQDHglDY4hLsga8dnr+X8hSq4QHXXP0xYj:XWVfQFObuRejlDYzgFnr+Mn46XPT
TLSH
T19183020DC78449A4F17163DAE63D903257BE19E9102AA59FED38CC09BA77C0AB2D063C
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/ICON/3.ico

SHA256 38dfffec749af3cecb110025cdd2830d2b07211c4b9373476652da9f876e4a60
MD5 0599195765cbf6d1eec68886698c719c
SHA1 e523bb990670f00feb456bb78f78b5c0bd350210
SHA512 e7da20295fd17b1f54f84f492fa6602eface8647bba8ffa0ea871cfbe52ba7499ca2dacd2849f5c76a3a9adf0ab30654659a3de16f6bc7e057d6f0577054f2a9
SSDEEP 768:q9IzNgdHBYYw3a9OnlPIAA32fFBp6p/J6Mc0ikogwO:0dhCnlQ5ceJ3c0iw
TLSH
T10263BFE67D44DDC8D8644E324BEBE07D94747C777D1B9E83B0A53B8F0630A91AA0609B
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/ICON/4.ico

SHA256 fc5a7d2056eb88a363faa606dbe4b3ae7eee2577af0a520453feed02e699d6d8
MD5 7b1f0fdc21bd125685fcebb144554135
SHA1 43ba453a42de33ce3a671b2b6a3f3bb41c640360
SHA512 22137ad5c2e3db3d977fa8604a865b23b48decf5cfce0aa024004d7cd39cb2901b8b50c6d2c876b2c9ac67a067e57f00fe4f97c50cfad0de1da0bf089be1ab81
SSDEEP 768:7StLC1zc0TE3fr1cqXNjZ/nFIWJNaViU5WK/:7AC1HErhdjtiWJNaVt/
TLSH
T13403AE687E19ECD8D82EA773C876C4085C353E317C9B95D7319A334E65700B6AE5FA80
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/ICON/5.ico

SHA256 93b7c60d9ed7df3683a402796b4dd885705852645bc3e9d984073af0ca555d68
MD5 f7aaf8ebe87fcf8f1e1d8d78bbf792aa
SHA1 224f0ffcf66d9523eaca29f43e3bc616313eb84f
SHA512 e1e7a60add3df0d1c46c89422799f5be26df2c5f57b6b0b90d4e831cc6199c7c832610e1c875fd63e8ae5a2bda974132394e2d200d7287b2371b0e093c73826a
SSDEEP 192:7PT5XDUosQ2PDIKFZ+KIWOSTwFP9oUy4psq3vsUsntN9bkrISk4TPaa1+4IdJUg:7Pyf1LIMZxgQwXoUybqfsUctHMTSkXg
TLSH
T138A29EA4BADBECC8E01B8032DD53C13829123C325485569F71E2BB7F7E31564E366D68
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/ICON/6.ico

SHA256 acc0867204f4fae01208d9abad85bfcd1013fdaf1bc81c7b81f74c9eb27e4830
MD5 61048633ae3c5932776af648ad96919a
SHA1 870ede5dc99f810f66d688ab927e56de59dfa63a
SHA512 c2b3e0eb58d3c2e9babbe88080230640fa257d74ae7f3667b30615f95da1c892b89de2ee8e9ba52c20953bdd44f7878734196b7b190aa779451ccb89a75a9e4b
SSDEEP 384:QG9GOHtch/TksB8LVyhUEvEW3xQ6oLNoH:Q+9S70sUk3xQ6oLWH
TLSH
T14672BFC7394A3CE0FC6E5C30C1A3C6A9E8107D3624509AEF3BD2BF5F2971598666A481
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/ICON/7.ico

SHA256 ca0b964780b8f8164d2eccef655cc74af98490d0c610a0accca79bfad2dd60a6
MD5 3dbfe32d723a1bc0bec2dae58bcaa806
SHA1 e0da0e651c15b24eb168b04760591d48c729233f
SHA512 4599e09954db8d47f9599f3ded382ea7157527dfe52d957afa941da5acb9a3864953b14f52ff2f9eb13dec4f6ee0dc348118904c3576fa04c452728f9922f7f1
SSDEEP 192:GcPo7GbvJPoeqQYyM3xBVfdXcf+SXz5VcrB:GcPo7G7Zoeg7xBVfO2SXV2B
TLSH
T13A126DB4AB7384C8EC051AB29563C93949B0BC369D2193A760C46FD716106D49FA5CFE
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/ICON/8.ico

SHA256 9ab9b822598385206889df81177a5fdca2ea4c0f57610ab4fe1340651f8dab71
MD5 0bfbe150d303462c30311002668a50f8
SHA1 1a3854c5b38e71dab0402cc233d76f9b043a1bff
SHA512 05be0b4e1d3c1c707783877c50183fdd0e13bb7d25dc85e451cf2978368ae0486f4a09da45bf4387d651dcf83e0aa517f621df1042988c9d4b37c498f2362ec7
SSDEEP 48:DrcSu3PR3BTpAdb/kIJN/UZ4vFMUekZW7ojO9cfAjoZ3/NiBzQENfWbB9wr7tE:Drc3FBKdhjUZBkOoxovQENW3A7W
TLSH
T12B913936AB157EACEB022D74B503854703680CABFA566F37C7DE82CB5DB0594A84183D
MD5 SHA1 SHA512 SSDEEP TLSH

.rsrc/ICON/9.ico

SHA256 892f838f0114bb6d7dd1d6096d5390e94c230ffdb41d98ea74f1a758767bfd12
MD5 8bfd4b84a5b73dfbec646e80eddf914a
SHA1 8299f8fc675ece420e512afed5bb9a084f64ea59
SHA512 484e77e748bf29375df7af7c8f21aab9b4c4f1eacfb22d03050dd87599f8658fe01a3f2ef83823cf6a46643083f42e50b996da834663db73b58faa6b11e94bba
TLSH
T1EC511A1A3F055C60C5147E7108D6256F8BE8A93238136FEF27400E562CF5178CBC3A9B
MD5 SHA1 SHA512 TLSH

.rsrc/MANIFEST/1

SHA256 8ef5bf7c993b92c1214abc4ee521b816ffdb3f3c0a6f9088356fae8fbe975865
MD5 fa3478e665ee83dba96e3eca94012a34
SHA1 4882e0f0432aa61925f4a94e852b1a64ae43cf2b
SHA512 8c1b00b013dcc7b034968bec3c9032accb3285d7e604f303e402aaadfd9d1a21fd5056d85cf0176762377e8238deeb0ebb6dc9933f3cac1d735cb6c377f823a8
TLSH
T12D01AF91C52890A6A35102E73A34E5491579E76F0CCC4AFCC8C65A2DA202A8B8662195
MD5 SHA1 SHA512 TLSH

.rsrc/version.txt

SHA256 a552aa0c2d896ee253300db660011e3d076fc40488040c7a696e5311eeeadc7e
MD5 d4f1b0869eee8e9eebd4445e2e6a1f11
SHA1 1b7ec81e5b1f8a79dbdc5c8d89cedd1e93be2b60
SHA512 7872c904f2f74e799176f85dce6372dd9b9993dd0b949edd0ebd67be5835db7a9d5249a1abde78a05c5a9f5cdd1a0442513df59ac693c49c89afb87278158485
TLSH
T16E21C81BA1FB3298A0B7A59E8EDACD3543577910453D961E94CC7E5E0FD34006512BF3
MD5 SHA1 SHA512 TLSH

.text

SHA256 6683c31450d22725f8046313577f87ed284052143421d41ca971ebf03a732b4a
MD5 6f5abe9eeda26ee84b3c1ed1a6c82001
SHA1 55517dc6ad93689679677d152abfdd1ce20f1135
SHA512 bdc2800a0b2b5460a5161eeeb0e73abc45895ab7086375625a3723bf0e8c97e1311f08032e08cebfc751f7da2d0d162332c6d4144b325b8e04b5e37456b56939
SSDEEP 768:TXWsAYF0UQj0TU9a+IWNu9B1MxlthhMLWI02:TmsAYBdTU9fEAIS2
TLSH
T1C1C27D287AE0D0B3DCA306720F7D67B6BFE6C62215E4598713201F987973692DA0F752
MD5 SHA1 SHA512 SSDEEP TLSH

EyRvUwMZ

SHA256 edc22f06daef784dd7cfc3da511b287714a26eb72311a0cee1fbc88c922712b2
MD5 1e3193c61e90e09c5efda23db0e5bbd3
SHA1 3e10765676b623c9a0bac1cc9636403cd503b4da
SHA512 e88e9cff276142cd22d07ce165b87adce8ae1aa90e240fa3ff21c1ee52ddb9327a789688d32557a45581d52afdffdc063a7eaed0b0c5959298918a44d83be018
TLSH
T1FF512F0542F50D57DE6AFE74756E0A1FCCEA145A706EB70821A0F06EFAB1D62C826372
MD5 SHA1 SHA512 TLSH

pbAsMCKL

SHA256 e0c463faf4b476399d19d8b74b83b0d9b08cab613e0be2df0cd41fd3a1ba9580
MD5 1b6fd01d69fbf263ef9ac8102987de41
SHA1 6d91f70dd1e19e2ad3a943d2c00275d9ffb91606
SHA512 3cc75bbbf28ca40a65106d76b8ab29673b9cf895b77b5c227faf6dd2f2c10a2cc8e31a2274e4b2babd63ef966d981e7be06e7895f561d419b56255476783e42f
SSDEEP 1536:z4WvLKb7TQdL31Aq+3WdRqer9B+TfS+yK+d4c+nXkPXVcHpvfOXJ49Hol9dlOdVx:ow3mkRqer5+ncloOZ4FoVj5gJ
TLSH
T129B3F70E766998D7DD728E30AC3086916733B8D76E515A7728C4530E8C6B2F88E26F34
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer