2026-07-27_1358b797f55926daa1e6e1abd2c84ade_cobalt-strike_icedid_njrat

General

Target
2026-07-27_1358b797f55926daa1e6e1abd2c84ade_cobalt-strike_icedid_njrat
Size 375KB
Sample260727-ed2adsgp3w
SHA256 1eeab4744800ab00b7b8880e66e4a371e475a292fafd46b2b5ac4f361269b9c4
MD5 1358b797f55926daa1e6e1abd2c84ade
SHA1 30c72c03b8a47975681a3d62ebe389e4c9d9c73f
SHA512 a9abf7be725635bfde4605a89069299a269aed1d035a8b0d11a9cf14eaf3d7fe17757bf154aa59f0b3c1b3520233ccad3c1353e8c527162d4bb504d448594c78
SSDEEP 6144:e9Uiae7W1ziXhDgKpAbN2aQWoH4cw3IT9Wa5:e9dV7W1ziXhDgKpAR0TUE
TLSH
T12584A45AFBF610E4E5BAC13895A2312AFC7138A54738EBD79685460B1B30BE4ED3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_1358b797f55926daa1e6e1abd2c84ade_cobalt-strike_icedid_njrat

File Explorer

2026-07-27_1358b797f55926daa1e6e1abd2c84ade_cobalt-strike_icedid_njrat

.exe 375KB

2026-07-27_1358b797f55926daa1e6e1abd2c84ade_cobalt-strike_icedid_njrat

IMPHASH e497fb5571a7f5cde13bf6da110e6cf0
SHA256 1eeab4744800ab00b7b8880e66e4a371e475a292fafd46b2b5ac4f361269b9c4
MD5 1358b797f55926daa1e6e1abd2c84ade
SHA1 30c72c03b8a47975681a3d62ebe389e4c9d9c73f
SHA512 a9abf7be725635bfde4605a89069299a269aed1d035a8b0d11a9cf14eaf3d7fe17757bf154aa59f0b3c1b3520233ccad3c1353e8c527162d4bb504d448594c78
SSDEEP 6144:e9Uiae7W1ziXhDgKpAbN2aQWoH4cw3IT9Wa5:e9dV7W1ziXhDgKpAR0TUE
TLSH
T12584A45AFBF610E4E5BAC13895A2312AFC7138A54738EBD79685460B1B30BE4ED3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WriteProcessMemory CreateToolhelp32Snapshot CloseHandle VirtualProtectEx VirtualAllocEx ReadProcessMemory VirtualFreeEx VirtualFree VirtualAlloc Module32First CreateFileW OpenProcess Sleep LoadLibraryW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx HeapQueryInformation HeapReAlloc HeapFree GetStringTypeW SetStdHandle GetProcessHeap EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetModuleFileNameW GetModuleHandleExW ExitProcess GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapSize HeapValidate GetSystemInfo GetFileType OutputDebugStringW WriteConsoleW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW

user32

FindWindowA UnhookWindowsHookEx SetWindowsHookExA PostThreadMessageA GetWindowThreadProcessId

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlImageNtHeader

Name

.text

Size

269KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_1358b797f55926daa1e6e1abd2c84ade_cobalt-strike_icedid_njrat

kernel32

user32

ntdll

generic