2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk
Size 181KB
Sample260707-ejxjdsev7l
SHA256 bac3505f700808862758ebc416fb4d0c94c6c81b0dc48fa6b7094b9c2d549e02
MD5 4ad8439b7cee77da6bce544a1cc8c5ec
SHA1 288660d1892d4e1f2f6c0ff1fbe559d46970ffd5
SHA512 4e01ec1225225971213e48ff43f351f55b7e4d41ab20053b68fe21fbc960f40e76a6e69cbc10f7adeace5e4c23313fcf0faeb0f97e6490ed795c951c50988139
SSDEEP 3072:YNmVNvivvrMEC/sF3ME231Uj+ub5y0em8SWVjKFRFye1yN+ptbm:3inrMECURAislSzS+
TLSH
T149042A0073EA11E9F1B386388A755952D6737C110B34ABEF0268066ADF33BD19D79F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_DisableWinDefender

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk

File Explorer

2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk

.exe 181KB

2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk

IMPHASH d00cd245a8097f66036ab8535af42256
SHA256 bac3505f700808862758ebc416fb4d0c94c6c81b0dc48fa6b7094b9c2d549e02
MD5 4ad8439b7cee77da6bce544a1cc8c5ec
SHA1 288660d1892d4e1f2f6c0ff1fbe559d46970ffd5
SHA512 4e01ec1225225971213e48ff43f351f55b7e4d41ab20053b68fe21fbc960f40e76a6e69cbc10f7adeace5e4c23313fcf0faeb0f97e6490ed795c951c50988139
SSDEEP 3072:YNmVNvivvrMEC/sF3ME231Uj+ub5y0em8SWVjKFRFye1yN+ptbm:3inrMECURAislSzS+
TLSH
T149042A0073EA11E9F1B386388A755952D6737C110B34ABEF0268066ADF33BD19D79F62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing artifacts associated with disabling Widnows Defender
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

99312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AllocateAndInitializeSid ChangeServiceConfig2W ChangeServiceConfigW CheckTokenMembership CloseServiceHandle ControlService CreateServiceW DeleteService FreeSid OpenSCManagerW OpenServiceW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegSetValueExW

shell32

SHGetFolderPathW ShellExecuteW

user32

MessageBoxW SystemParametersInfoW

ole32

CoCreateInstance CoInitializeEx CoUninitialize

kernel32

CloseHandle CopyFileW CreateFileW CreateRemoteThread CreateToolhelp32Snapshot CreateWaitableTimerW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileSizeEx GetFileType GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemTimeAsFileTime GetTempPathW HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExW MoveFileW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter RaiseException ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFileAttributesW SetFilePointer SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SetWaitableTimer TerminateProcess UnhandledExceptionFilter VirtualAllocEx VirtualFreeEx VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

Name

.text

Size

168KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_4ad8439b7cee77da6bce544a1cc8c5ec_cobalt-strike_icedid_ngrbot_njrat_ryuk

advapi32

shell32

user32

ole32

kernel32

generic