2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk

General

Target
2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk
Size 3.5MB
Sample260706-2mr5eah15p
SHA256 35fdf1618868600a488f08b5b60c2cb4f0cc9220b00a59b91c53f179a3e40b6a
MD5 0ec9b8f144ac5766afa1e854c4a6714c
SHA1 a56ed4b58b625b0cdd7d911c084f7a74684f205a
SHA512 55d1b3de6caa8ff39643d6e217f79ba37c668702b708cd3d776a28dd6c41a0104ca4e026a0903fd0a67e80875e884534c551fb5cd84acf42bc7053b2dc5531a4
SSDEEP 49152:hUcRqkaITh5CTi8JJzJp5vddF4VloboZUcJhd7FZZYhAM8kDZgSJYGXguEA8bdm+:Xct9JJzz/kPn678cHFTE
TLSH
T15206F11591D411F9C467C278CA8B1A0BF7A2B409732AAEDF02C549422F63FE25F7E359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk

File Explorer

2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk

.exe 3.5MB

2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk

IMPHASH 633c999994fa0062226eaf117e8e677f
SHA256 35fdf1618868600a488f08b5b60c2cb4f0cc9220b00a59b91c53f179a3e40b6a
MD5 0ec9b8f144ac5766afa1e854c4a6714c
SHA1 a56ed4b58b625b0cdd7d911c084f7a74684f205a
SHA512 55d1b3de6caa8ff39643d6e217f79ba37c668702b708cd3d776a28dd6c41a0104ca4e026a0903fd0a67e80875e884534c551fb5cd84acf42bc7053b2dc5531a4
SSDEEP 49152:hUcRqkaITh5CTi8JJzJp5vddF4VloboZUcJhd7FZZYhAM8kDZgSJYGXguEA8bdm+:Xct9JJzz/kPn678cHFTE
TLSH
T15206F11591D411F9C467C278CA8B1A0BF7A2B409732AAEDF02C549422F63FE25F7E359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

933600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSAGetLastError WSAStartup __WSAFDIsSet closesocket connect freeaddrinfo getaddrinfo inet_pton ioctlsocket recv select send shutdown socket

kernel32

AreFileApisANSI CloseHandle CompareStringW CreateFile2 CreateFileW CreateProcessW DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LocalFree MoveFileExA MoveFileExW MultiByteToWideChar QueryPerformanceCounter RaiseException ReadConsoleW ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

bcrypt

BCryptGenRandom

Name

.std

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data0

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

422B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_0ec9b8f144ac5766afa1e854c4a6714c_cobalt-strike_gazer_helldown_icedid_njrat_remcos_ryuk

ws2_32

kernel32

bcrypt

generic