2026-07-12_d0077afd3f56de021684bafa0c688d7a_cobalt-strike_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-12_d0077afd3f56de021684bafa0c688d7a_cobalt-strike_icedid_njrat_stealc
Size 1.4MB
Sample260712-thdr8acx9k
SHA256 bf9dc78a9e05d9064fbd64ec541ab848eda26c1c6e1f4260e9ea352131c5c4dc
MD5 d0077afd3f56de021684bafa0c688d7a
SHA1 5aecf08a39354d8981607324d620578d3c6075a6
SHA512 53e8daa52dd01a8b2eaed95d5f3b33e95769fa9616d087e4de59878d0a242cc98aebb52bbeaf635fe668f0f563a4aab09c54c7fb9069c3252709bc298838fe9e
SSDEEP 24576:eGltdViqFFOtjMhDtpLdR/qj+m3nQ6Ok9zaZcnnXATNZqiPvR4:eEJ6RqdR/qTnnL5TnXANvR4
TLSH
T1C965BE42F3A602ECC56B9138C626C31BF73538051724A7DB76E41B696F53AF05EBA390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-12_d0077afd3f56de021684bafa0c688d7a_cobalt-strike_icedid_njrat_stealc

File Explorer

2026-07-12_d0077afd3f56de021684bafa0c688d7a_cobalt-strike_icedid_njrat_stealc

.exe 1.4MB

2026-07-12_d0077afd3f56de021684bafa0c688d7a_cobalt-strike_icedid_njrat_stealc

IMPHASH ca14a5d15af95d540d08a4ace161bc16
SHA256 bf9dc78a9e05d9064fbd64ec541ab848eda26c1c6e1f4260e9ea352131c5c4dc
MD5 d0077afd3f56de021684bafa0c688d7a
SHA1 5aecf08a39354d8981607324d620578d3c6075a6
SHA512 53e8daa52dd01a8b2eaed95d5f3b33e95769fa9616d087e4de59878d0a242cc98aebb52bbeaf635fe668f0f563a4aab09c54c7fb9069c3252709bc298838fe9e
SSDEEP 24576:eGltdViqFFOtjMhDtpLdR/qj+m3nQ6Ok9zaZcnnXATNZqiPvR4:eEJ6RqdR/qTnnL5TnXANvR4
TLSH
T1C965BE42F3A602ECC56B9138C626C31BF73538051724A7DB76E41B696F53AF05EBA390
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

263312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Kyrix\Desktop\peroxidehook-loader-main\build\release\peroxide-loader.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

user32

GetClipboardData EmptyClipboard CloseClipboard SetClipboardData GetCursorPos DefWindowProcW GetWindowRect DestroyWindow SetWindowPos CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW TranslateMessage PostQuitMessage GetDesktopWindow UpdateWindow GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetConsoleOutputCP FlushFileBuffers LCMapStringW LoadLibraryExW VirtualProtect CreateFileW GetFileType ReadConsoleW GetConsoleMode SetFilePointerEx UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter LoadLibraryW GetModuleHandleW RtlCaptureContext SetStdHandle GetStringTypeW HeapSize WriteConsoleW GetCurrentThreadId IsProcessorFeaturePresent WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId SetEndOfFile GetSystemTimeAsFileTime InitializeSListHead CreateFileA GetFileSizeEx ReadFile CloseHandle HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlUnwind GetCurrentProcess ExitProcess TerminateProcess

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

dwmapi

DwmExtendFrameIntoClientArea

Name

.text

Size

811KB

Virtual Size

811KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

234KB

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

340KB

Virtual Size

343KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_d0077afd3f56de021684bafa0c688d7a_cobalt-strike_icedid_njrat_stealc

d3d11

d3dcompiler_47

user32

kernel32

imm32

dwmapi

generic