2026-07-10_7d26da31bce134024f73cbc571b93d04_cobalt-strike_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-10_7d26da31bce134024f73cbc571b93d04_cobalt-strike_icedid_njrat
Size 261KB
Sample260710-nvpscsby2x
SHA256 4b294c8b862c1f3ce5d54c2d438da2963d9f036491585814059272efbab56291
MD5 7d26da31bce134024f73cbc571b93d04
SHA1 40e350334dc454573012be05597a35429d835e26
SHA512 f092cbc04df00ddd1821b3da8864a9bad4dbd2cf9ccac51a4d04b29f23de7fb0b25ed2aacd60bb75222a5295a68cb5121aed5e74ef784b7a7250f6553320216e
SSDEEP 3072:Qb4h2T68Vaoz+O0q3fkBnuTGglb74rTTPWAUtzfSDOQvRIzPGdkE2dr+aHr5oY4k:Qe2T69P8sB+vIWmD2oadrNohb0jPYU
TLSH
T11B44D021F2D48CDAED76053C5C91A1083A767C84CB35DD3B05A4C76B8EE72A4AD2DDE4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-10_7d26da31bce134024f73cbc571b93d04_cobalt-strike_icedid_njrat

File Explorer

2026-07-10_7d26da31bce134024f73cbc571b93d04_cobalt-strike_icedid_njrat

.exe 261KB

2026-07-10_7d26da31bce134024f73cbc571b93d04_cobalt-strike_icedid_njrat

IMPHASH 0a6b39756055484e632cf9acb2c9e786
SHA256 4b294c8b862c1f3ce5d54c2d438da2963d9f036491585814059272efbab56291
MD5 7d26da31bce134024f73cbc571b93d04
SHA1 40e350334dc454573012be05597a35429d835e26
SHA512 f092cbc04df00ddd1821b3da8864a9bad4dbd2cf9ccac51a4d04b29f23de7fb0b25ed2aacd60bb75222a5295a68cb5121aed5e74ef784b7a7250f6553320216e
SSDEEP 3072:Qb4h2T68Vaoz+O0q3fkBnuTGglb74rTTPWAUtzfSDOQvRIzPGdkE2dr+aHr5oY4k:Qe2T69P8sB+vIWmD2oadrNohb0jPYU
TLSH
T11B44D021F2D48CDAED76053C5C91A1083A767C84CB35DD3B05A4C76B8EE72A4AD2DDE4
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

176128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\porca\source\repos\revshell\x64\Release\revshell.pdb

kernel32

VirtualProtect SetHandleInformation WaitForSingleObject Sleep GetLastError CloseHandle CreateProcessW WriteConsoleW CreateFileW HeapSize HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CompareStringW LCMapStringW GetProcessHeap RtlUnwind

ws2_32

closesocket shutdown WSASocketW inet_pton WSAConnect htons setsockopt WSAGetLastError WSAStartup

Name

.text

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dec

Size

512B

Virtual Size

391B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.dec

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-10_7d26da31bce134024f73cbc571b93d04_cobalt-strike_icedid_njrat

kernel32

ws2_32

generic