2026-07-27_149414e6ee10bbdb20260698afdded0e_cobalt-strike_icedid_njrat

General

Target
2026-07-27_149414e6ee10bbdb20260698afdded0e_cobalt-strike_icedid_njrat
Size 749KB
Sample260727-edy52avfmb
SHA256 566325e0527916d2e4488ab8c3d3d5a506ded0a9c6f0830a8fa658e9bcf36406
MD5 149414e6ee10bbdb20260698afdded0e
SHA1 d29bb57748ce3d8b66f0ccfb2e85b4b886ff0a69
SHA512 5e98f64cf69dae5ea494ccaf7c00a9ba00b6c9c901372f19c232f9987bf617a453736ca7154eaa2e2b89aefd31527926056031b85a1df88fa5013f3908b90a06
SSDEEP 12288:QP8eeSLVen2Rup3LSHqvQksb27/vnsiXhRgtkp0XP54:W8eeSLVvRup3LSksbi/v9+kq/
TLSH
T1B2F4091AF6F610E4E5BAC1799962312AFC713CA54734ABCB57804A0A1F31FE49E3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_149414e6ee10bbdb20260698afdded0e_cobalt-strike_icedid_njrat

File Explorer

2026-07-27_149414e6ee10bbdb20260698afdded0e_cobalt-strike_icedid_njrat

.exe 749KB

2026-07-27_149414e6ee10bbdb20260698afdded0e_cobalt-strike_icedid_njrat

IMPHASH 5d5308248aa869048e099b3b962d9aab
SHA256 566325e0527916d2e4488ab8c3d3d5a506ded0a9c6f0830a8fa658e9bcf36406
MD5 149414e6ee10bbdb20260698afdded0e
SHA1 d29bb57748ce3d8b66f0ccfb2e85b4b886ff0a69
SHA512 5e98f64cf69dae5ea494ccaf7c00a9ba00b6c9c901372f19c232f9987bf617a453736ca7154eaa2e2b89aefd31527926056031b85a1df88fa5013f3908b90a06
SSDEEP 12288:QP8eeSLVen2Rup3LSHqvQksb27/vnsiXhRgtkp0XP54:W8eeSLVvRup3LSksbi/v9+kq/
TLSH
T1B2F4091AF6F610E4E5BAC1799962312AFC713CA54734ABCB57804A0A1F31FE49E3E741
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

154080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle GetProcAddress GetModuleHandleA GetModuleFileNameW GetTempPathW SetEndOfFile GetCurrentThreadId CreateFileW VirtualAlloc DeviceIoControl GetCurrentProcessId VirtualFree SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP MultiByteToWideChar LocalFree FormatMessageA GetLocaleInfoEx GetStringTypeW WideCharToMultiByte FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetLastError GetModuleHandleW GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW DeleteFileW HeapAlloc HeapSize HeapValidate GetSystemInfo ExitProcess GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetFileType OutputDebugStringW WriteConsoleW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapReAlloc HeapQueryInformation GetProcessHeap FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW IsValidCodePage RtlUnwind

advapi32

RegCloseKey RegDeleteTreeW RegCreateKeyW RegOpenKeyW RegSetKeyValueW

ntdll

NtUnloadDriver NtQuerySystemInformation RtlAdjustPrivilege NtLoadDriver RtlInitUnicodeString

Name

.text

Size

521KB

Virtual Size

520KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

179KB

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_149414e6ee10bbdb20260698afdded0e_cobalt-strike_icedid_njrat

kernel32

advapi32

ntdll

generic