2026-07-22_faddd1b8dd212905f07db5cddf0bba63_cobalt-strike_elex_icedid_njrat

General

Target
2026-07-22_faddd1b8dd212905f07db5cddf0bba63_cobalt-strike_elex_icedid_njrat
Size 424KB
Sample260722-zgdcysvalh
SHA256 143ec5fb4819edd57a56b0ae6315a325a9c3b81d8e7b402183043831871223fe
MD5 faddd1b8dd212905f07db5cddf0bba63
SHA1 447f5a29373e9d1602790d81969d83de443ea545
SHA512 d4c518e8e4c80ef8afb591b8bbaf8d471fd8442a67271aa5381118c88b7eb218e586303536c69fb9ae3d997d3553bb71bd34b8c610a78732a2898bfdd26cb90a
SSDEEP 3072:BPMZbVw3mkRqer5+ncloOZ4FoVj5lgdA53Pa4sjSTXEHb5CZCq5DACsVlNl7HIJt:Bg5Sqer5+nDFohgmsjF4N5QVrZZ7Lxe
TLSH
T19794061D7A4F90D6DB620A392CB89690C6B5FD73DA502067B7C4730B5C3B2E38E25726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_faddd1b8dd212905f07db5cddf0bba63_cobalt-strike_elex_icedid_njrat

File Explorer

2026-07-22_faddd1b8dd212905f07db5cddf0bba63_cobalt-strike_elex_icedid_njrat

.exe 424KB

2026-07-22_faddd1b8dd212905f07db5cddf0bba63_cobalt-strike_elex_icedid_njrat

IMPHASH 0ab8af968841351a6340b418cb8a364d
SHA256 143ec5fb4819edd57a56b0ae6315a325a9c3b81d8e7b402183043831871223fe
MD5 faddd1b8dd212905f07db5cddf0bba63
SHA1 447f5a29373e9d1602790d81969d83de443ea545
SHA512 d4c518e8e4c80ef8afb591b8bbaf8d471fd8442a67271aa5381118c88b7eb218e586303536c69fb9ae3d997d3553bb71bd34b8c610a78732a2898bfdd26cb90a
SSDEEP 3072:BPMZbVw3mkRqer5+ncloOZ4FoVj5lgdA53Pa4sjSTXEHb5CZCq5DACsVlNl7HIJt:Bg5Sqer5+nDFohgmsjF4N5QVrZZ7Lxe
TLSH
T19794061D7A4F90D6DB620A392CB89690C6B5FD73DA502067B7C4730B5C3B2E38E25726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

RegisterClassExA TranslateMessage PostQuitMessage LoadIconA LoadCursorA GetMessageA DispatchMessageA DefWindowProcA SendMessageA CreateWindowExA CharLowerA

kernel32

lstrlenA lstrcpyA lstrcmpiA BeginUpdateResourceA CloseHandle CopyFileA CreateFileA CreateFileMappingA CreateThread DeleteFileA EndUpdateResourceA EnumResourceNamesA ExitProcess FindClose FindFirstFileA FindNextFileA FindResourceA FreeLibrary GetCommandLineA GetDriveTypeA GetEnvironmentVariableA GetFileAttributesA GetFileSize GetModuleFileNameA GetModuleHandleA GetShortPathNameA GetSystemDefaultLangID GetTickCount GetWindowsDirectoryA GlobalAlloc GlobalFree LoadLibraryA LoadResource LockResource MapViewOfFile MoveFileA ReadFile RtlMoveMemory SetEndOfFile SetFilePointer SizeofResource Sleep UnmapViewOfFile UpdateResourceA WinExec WriteFile lstrcatA lstrcmpA

shlwapi

PathFindExtensionA

urlmon

URLDownloadToFileA

advapi32

RegCreateKeyA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCloseKey

shell32

ShellExecuteA

dbghelp

MakeSureDirectoryPathExists

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_faddd1b8dd212905f07db5cddf0bba63_cobalt-strike_elex_icedid_njrat

user32

kernel32

shlwapi

urlmon

advapi32

shell32

dbghelp

generic