2026-05-09_d207ed5c8955a97ae152a8a630106423_cobalt-strike_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-09_d207ed5c8955a97ae152a8a630106423_cobalt-strike_icedid_njrat_ryuk
Size 434KB
Sample260509-2wp2eaes4y
SHA256 ed4d68de25699fca2ce9d3a66236dfd096913b7e77efce77f29c8777dc4e4090
MD5 d207ed5c8955a97ae152a8a630106423
SHA1 bab01c6747e39be79829132123644d8f3075176b
SHA512 e06ecb67a5b27341e230c8468d21bd7de008a5edc3a2d9db5e3d6c3113c6d08ef6bbaf380e199630039c7c85f8fe32c05a82ce91e5b8ff9889bd42a67c01e946
SSDEEP 6144:1xzrWMEiqlERVcxQAvrte+QGDnnJ17mi0xXD+7wyJQUqOTclovQJXk0ZA16k8mhC:tIxQADteA71mXD412QvQJUSAN1AP3
TLSH
T1D0945C16EE5110FED49EC5788647E911AA357C8E3760F9CF07987A211EF2AE06B39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-05-09_d207ed5c8955a97ae152a8a630106423_cobalt-strike_icedid_njrat_ryuk

File Explorer

2026-05-09_d207ed5c8955a97ae152a8a630106423_cobalt-strike_icedid_njrat_ryuk

.exe 434KB

2026-05-09_d207ed5c8955a97ae152a8a630106423_cobalt-strike_icedid_njrat_ryuk

IMPHASH 789d00f8bf9b02909e21dbcb006743a2
SHA256 ed4d68de25699fca2ce9d3a66236dfd096913b7e77efce77f29c8777dc4e4090
MD5 d207ed5c8955a97ae152a8a630106423
SHA1 bab01c6747e39be79829132123644d8f3075176b
SHA512 e06ecb67a5b27341e230c8468d21bd7de008a5edc3a2d9db5e3d6c3113c6d08ef6bbaf380e199630039c7c85f8fe32c05a82ce91e5b8ff9889bd42a67c01e946
SSDEEP 6144:1xzrWMEiqlERVcxQAvrte+QGDnnJ17mi0xXD+7wyJQUqOTclovQJXk0ZA16k8mhC:tIxQADteA71mXD412QvQJUSAN1AP3
TLSH
T1D0945C16EE5110FED49EC5788647E911AA357C8E3760F9CF07987A211EF2AE06B39F10
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

64:c7:a9:f7:79:49:40:5d:2f:96:8d:56:bd:aa:42:97:84:09:51:36:7b:f5:20:0b:2a:88:91:9c:c3:6b:e3:94

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=numbAC-Test

Chains

May 8, 2026

CN=numbAC-Test

Subject

CN=numbAC-Test

Serial Number

1f:8c:86:10:f6:5a:ce:53:1d:65:83:ad:1f:2c:f9:f2:44:4f:d9:c0

Issuer

CN=numbAC-Test

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 5, 2026 - May 5, 2027

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Minor OS version

Major OS version

Entry point

279832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

CommandLineToArgvW Shell_NotifyIconW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider

wintrust

CryptCATAdminAcquireContext CryptCATAdminCalcHashFromFileHandle CryptCATAdminEnumCatalogFromHash CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseContext CryptCATCatalogInfoFromContext WinVerifyTrust

advapi32

ChangeServiceConfigW CloseServiceHandle ControlService CreateServiceW DeleteService OpenSCManagerW OpenServiceW QueryServiceStatusEx StartServiceW

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption WinHttpSetTimeouts WinHttpWebSocketClose WinHttpWebSocketCompleteUpgrade WinHttpWebSocketReceive WinHttpWebSocketSend WinHttpWebSocketShutdown

d2d1

ord1

dwrite

DWriteCreateFactory

ole32

CoCreateInstance CoInitializeEx CoUninitialize

user32

AppendMenuW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyMenu DestroyWindow DispatchMessageW EnumWindows GetCursorPos GetDC GetMessageW GetSystemMetrics GetWindowLongPtrW GetWindowThreadProcessId IsWindowVisible LoadCursorW LoadIconW MessageBoxW PostMessageW PostQuitMessage RegisterClassExW ReleaseDC SetForegroundWindow SetWindowPos ShowWindow TrackPopupMenu TranslateMessage UpdateLayeredWindow

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler CloseHandle CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeviceIoControl EncodePointer EnterCriticalSection ExitProcess ExitThread FindClose FindFirstFileExW FindNextFileW FindResourceW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleCP GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetExitCodeThread GetFileAttributesW GetFileType GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTempPathW HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage K32EnumProcessModulesEx K32GetModuleInformation LCMapStringW LeaveCriticalSection LoadLibraryExW LoadResource LocalFree LockResource MoveFileExW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetErrorMode SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SizeofResource Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

ntdll

NtQuerySystemInformation

gdi32

CreateCompatibleDC CreateDIBSection DeleteDC DeleteObject SelectObject

Name

.text

Size

274KB

Virtual Size

274KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

132B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-09_d207ed5c8955a97ae152a8a630106423_cobalt-strike_icedid_njrat_ryuk

PE Signature issue

shell32

bcrypt

wintrust

advapi32

winhttp

d2d1

dwrite

ole32

user32

kernel32

ntdll

gdi32

generic