2026-07-07_7dbb99f99efaa2cf6e822275677fb0be_cobalt-strike_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-07_7dbb99f99efaa2cf6e822275677fb0be_cobalt-strike_icedid_njrat
Size 1.9MB
Sample260707-mc8bbafx2z
SHA256 52217119ea74e7f20ca948069a64597efc2517fc6610ddd8b6cfc1760d9e38a3
MD5 7dbb99f99efaa2cf6e822275677fb0be
SHA1 5b4565f8061c69d34a7163475a7bbe6f6d1edc57
SHA512 cc651895e90d0bd2921653d6f821c128833446d5668c7126a74ba1e932218e67446ed077026eb9a03543747792fbc339cbea5b8c27fef9ad05c6cec35f062f1a
SSDEEP 24576:t4OIZNnfirjtesjZc2PxOh32VQjBUuD514zEmBrpcP:y6PjCA8S4B517
TLSH
T148959D2672AC01D5F277D27D89DB4A4ADAF27809033296CB019446DD2F27EED0E7F621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-07_7dbb99f99efaa2cf6e822275677fb0be_cobalt-strike_icedid_njrat

File Explorer

2026-07-07_7dbb99f99efaa2cf6e822275677fb0be_cobalt-strike_icedid_njrat

.exe 1.9MB

2026-07-07_7dbb99f99efaa2cf6e822275677fb0be_cobalt-strike_icedid_njrat

IMPHASH 740a3ac2f74a50bbf47b7896f9f6fb26
SHA256 52217119ea74e7f20ca948069a64597efc2517fc6610ddd8b6cfc1760d9e38a3
MD5 7dbb99f99efaa2cf6e822275677fb0be
SHA1 5b4565f8061c69d34a7163475a7bbe6f6d1edc57
SHA512 cc651895e90d0bd2921653d6f821c128833446d5668c7126a74ba1e932218e67446ed077026eb9a03543747792fbc339cbea5b8c27fef9ad05c6cec35f062f1a
SSDEEP 24576:t4OIZNnfirjtesjZc2PxOh32VQjBUuD514zEmBrpcP:y6PjCA8S4B517
TLSH
T148959D2672AC01D5F277D27D89DB4A4ADAF27809033296CB019446DD2F27EED0E7F621
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15866

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\thiag\Downloads\key\build\eni_keylogger.pdb

user32

SwitchDesktop CloseDesktop GetMessageW TranslateMessage DispatchMessageW PeekMessageW RegisterHotKey UnregisterHotKey SendMessageW DefWindowProcW PostQuitMessage RegisterClassW CreateWindowExW DestroyWindow ShowWindow OpenClipboard CloseClipboard LoadCursorW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetWindowThreadProcessId FindWindowW SetRect MessageBoxW GetWindowTextW SetWindowTextW ReleaseDC GetDC SetForegroundWindow GetForegroundWindow UpdateWindow GetSystemMetrics EnableWindow GetKeyState EnumClipboardFormats GetClipboardData ChangeClipboardChain SetClipboardViewer OpenDesktopW

gdi32

GetObjectW CreateDIBSection SelectObject DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt

winmm

waveInGetDevCapsW waveInOpen waveInClose waveInPrepareHeader waveInUnprepareHeader waveInAddBuffer waveInStart waveInGetNumDevs waveInReset waveInStop

avifil32

AVIFileExit AVIFileInit AVIFileRelease AVIStreamWrite AVIStreamSetFormat AVIStreamRelease AVIFileCreateStreamW AVIFileOpenW

ole32

CoCreateInstance CoTaskMemFree CoInitializeEx CoUninitialize

oleaut32

VariantChangeType GetErrorInfo SetErrorInfo CreateErrorInfo SysFreeString SysAllocString VariantInit VariantClear

comctl32

ord17

advapi32

RegSetValueExW RegOpenKeyExW RegDeleteValueW RegCloseKey DuplicateTokenEx OpenProcessToken CreateProcessAsUserW

shell32

SHGetFolderPathW SHCreateDirectoryExW

kernel32

IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect IsThreadAFiber GetTempPathW SetFilePointerEx GetFileSizeEx GetFileType EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW SetConsoleCtrlHandler IsValidCodePage GetUserDefaultLCID HeapFree HeapAlloc GetCurrentThread UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext WriteFile GetStdHandle GetProcAddress TerminateProcess GetACP GetOEMCP HeapReAlloc GetTimeZoneInformation FindFirstFileExW FindNextFileW GetCommandLineA GetCommandLineW GetEnvironmentStringsW ExitProcess GetCurrentProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ResumeThread ExitThread CreateThread FlsFree FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap OutputDebugStringW SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile QueryPerformanceCounter FlsSetValue FlsGetValue FlsAlloc FindClose FindFirstFileW GetFileAttributesW CloseHandle GetLastError CreateMutexW Sleep OpenProcess GetLocalTime GetModuleFileNameW GetModuleHandleW GlobalUnlock GlobalLock QueryFullProcessImageNameW CopyFileW WTSGetActiveConsoleSessionId CreateToolhelp32Snapshot Process32FirstW Process32NextW LocalFree RtlUnwind QueryPerformanceFrequency GetSystemTimePreciseAsFileTime WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetLogicalProcessorInformationEx ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared SleepConditionVariableSRW GetTickCount64 FormatMessageA WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WakeConditionVariable WakeAllConditionVariable GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetLastError InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader RaiseException

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

278KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-07_7dbb99f99efaa2cf6e822275677fb0be_cobalt-strike_icedid_njrat

user32

gdi32

winmm

avifil32

ole32

oleaut32

comctl32

advapi32

shell32

kernel32

generic