2026-07-27_8a2a1aed6f21eaee672b510cb4d35c70_cobalt-strike_hijackloader_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-27_8a2a1aed6f21eaee672b510cb4d35c70_cobalt-strike_hijackloader_icedid_njrat
Size 736KB
Sample260727-j5m93aaa67
SHA256 664f7488ff91f28d2b0a177980d792626d5c4541818c2603c2c97ffd03859b0d
MD5 8a2a1aed6f21eaee672b510cb4d35c70
SHA1 934efbdbd3b87d87209012ae52c32ebc61b18260
SHA512 6bf9614be41340847f39385f995a6258bb26ab9449d264847e529c61e5ae21fe02efc31a60e89cd7e2b98e173a54c1bf70830f018ed9d05d110b048f68a28b9c
SSDEEP 12288:0Z1dOXGkQH6gNVlrCOQU3kjCzDj5Ts9f8YonFnWJoa9w812Mg8+Jl7mUbYam6ATy:0ZTOXGkQH6gNLCOQuY3Joz8u8e7zYNAt
TLSH
T116F4288663EC42E4F1F3AA3899724156DB72BC524B35C2CF0254566E1E73AD18D3AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-27_8a2a1aed6f21eaee672b510cb4d35c70_cobalt-strike_hijackloader_icedid_njrat

File Explorer

2026-07-27_8a2a1aed6f21eaee672b510cb4d35c70_cobalt-strike_hijackloader_icedid_njrat

.exe 736KB

2026-07-27_8a2a1aed6f21eaee672b510cb4d35c70_cobalt-strike_hijackloader_icedid_njrat

IMPHASH 60338b3c4e0e8919bcbfb83161ecd649
SHA256 664f7488ff91f28d2b0a177980d792626d5c4541818c2603c2c97ffd03859b0d
MD5 8a2a1aed6f21eaee672b510cb4d35c70
SHA1 934efbdbd3b87d87209012ae52c32ebc61b18260
SHA512 6bf9614be41340847f39385f995a6258bb26ab9449d264847e529c61e5ae21fe02efc31a60e89cd7e2b98e173a54c1bf70830f018ed9d05d110b048f68a28b9c
SSDEEP 12288:0Z1dOXGkQH6gNVlrCOQU3kjCzDj5Ts9f8YonFnWJoa9w812Mg8+Jl7mUbYam6ATy:0ZTOXGkQH6gNLCOQuY3Joz8u8e7zYNAt
TLSH
T116F4288663EC42E4F1F3AA3899724156DB72BC524B35C2CF0254566E1E73AD18D3AB33
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

210880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\T\M\Acrobat\Installers\BootStrapExe_Small\Release_x64\Setup.pdb

kernel32

GetLocaleInfoW GetSystemDefaultUILanguage VirtualProtect GetFileAttributesW GetFileAttributesExW GetFileSizeEx GetFileTime SetErrorMode RaiseException VirtualQuery LoadLibraryExA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW WriteConsoleW GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExW GetTimeZoneInformation GetDriveTypeW SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP LCMapStringW ExitProcess GetStdHandle HeapQueryInformation GetCommandLineW GetCommandLineA GetFileType SetStdHandle FreeLibraryAndExitThread ExitThread CreateThread RtlPcToFileHeader RtlUnwindEx OutputDebugStringW LocalReAlloc LocalAlloc GlobalHandle GlobalReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSection GetCurrentProcessId WritePrivateProfileStringW GetPrivateProfileIntW GetCurrentThread FileTimeToSystemTime SystemTimeToTzSpecificLocalTime FileTimeToLocalFileTime DuplicateHandle GlobalFlags WriteFile UnlockFile SetFilePointer SetEndOfFile ReadFile LockFile GetVolumeInformationW GetFullPathNameW GetFileSize FlushFileBuffers lstrcmpA SuspendThread SetThreadPriority CreateEventW SetEvent CompareStringW GlobalFindAtomW GlobalAddAtomW GlobalDeleteAtom LoadLibraryExW FreeLibrary GetCurrentThreadId EncodePointer MulDiv GlobalFree GlobalLock GlobalUnlock GlobalAlloc QueryActCtxW FindActCtxSectionStringW DeactivateActCtx ActivateActCtx CreateActCtxW LoadLibraryW GetModuleHandleExW InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection OutputDebugStringA GetACP WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc DecodePointer GetUserDefaultUILanguage GetPrivateProfileStringW lstrlenW lstrcmpW GetModuleFileNameW GetVersionExW GetSystemInfo GetCurrentProcess GetTempFileNameW FindNextFileW FindFirstFileW FindClose DeleteFileW ExpandEnvironmentStringsW ResumeThread Sleep GetTempPathW CopyFileW GetSystemDirectoryW CreateProcessW GetExitCodeProcess WaitForSingleObject SetLastError GetLastError CloseHandle CreateFileW GetCurrentDirectoryW GetUserDefaultLangID FormatMessageW LocalFree FindResourceW SizeofResource LockResource LoadResource SetDllDirectoryW GetProcAddress GetModuleHandleW GetSystemWindowsDirectoryW SetCurrentDirectoryW

user32

CreateDialogIndirectParamW GetMonitorInfoW MonitorFromWindow WinHelpW LoadIconW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetLastActivePopup GetTopWindow GetClassNameW GetClassLongPtrW SetWindowLongPtrW GetWindowLongPtrW PtInRect CopyRect GetSysColor MapWindowPoints ScreenToClient MessageBoxW AdjustWindowRectEx GetWindowRect RemovePropW GetPropW SetPropW GetScrollPos RedrawWindow ValidateRect EndPaint BeginPaint SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow GetNextDlgTabItem GetMenu GetCapture GetKeyState IsIconic IsWindowVisible EndDeferWindowPos DeferWindowPos BeginDeferWindowPos DestroyWindow IsChild IsMenu CreateWindowExW DrawTextW GetClassInfoW RegisterClassW SendMessageW SetTimer KillTimer EnableWindow CallWindowProcW DefWindowProcW GetMessageTime GetMessagePos PeekMessageW DispatchMessageW RegisterWindowMessageW LoadBitmapW SetMenuItemInfoW GetMenuCheckMarkDimensions SetMenuItemBitmaps EnableMenuItem CheckMenuItem IsDialogMessageW GetWindow SetWindowLongW GetWindowLongW GetWindowTextW SetWindowTextW IsWindowEnabled GetFocus SetFocus GetActiveWindow GetDesktopWindow GetMessageW TranslateMessage GetCursorPos CharUpperW GetSystemMetrics PostQuitMessage SetCursor GetWindowThreadProcessId GetDC ReleaseDC GetSysColorBrush LoadCursorW ClientToScreen SetMenu PostMessageW EndDialog UnregisterClassW SendDlgItemMessageA GetClientRect SetRectEmpty OffsetRect GetParent GetSubMenu GetMenuItemID GetMenuItemCount IsWindow ShowWindow SetWindowPos GetDlgItem GetDlgCtrlID RealChildWindowFromPoint DrawTextExW GrayStringW DestroyMenu GetClassInfoExW InvalidateRect TabbedTextOutW

gdi32

PtVisible RectVisible RestoreDC SaveDC SelectObject SetMapMode GetStockObject TextOutW ExtTextOutW SetViewportExtEx SetViewportOrgEx SetWindowExtEx OffsetViewportOrgEx ScaleViewportExtEx ScaleWindowExtEx GetClipBox Escape DeleteObject GetObjectW SetTextColor SetBkColor CreateBitmap GetDeviceCaps DeleteDC

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegEnumValueW RegQueryValueW RegEnumKeyW RegDeleteValueW RegDeleteKeyW QueryServiceStatusEx OpenServiceW OpenSCManagerW CloseServiceHandle InitiateSystemShutdownW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteKeyExW RegCreateKeyExW RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

shell32

SHGetKnownFolderPath ShellExecuteW SHGetSpecialFolderPathW

shlwapi

PathFileExistsW PathRemoveFileSpecW PathIsUNCW PathStripToRootW PathFindExtensionW PathFindFileNameW

ole32

CoTaskMemFree CoCreateInstance CoUninitialize CoCreateGuid CoInitialize

oleaut32

SysAllocString VariantChangeType VariantClear VariantInit SysFreeString

Name

.text

Size

344KB

Virtual Size

343KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

134KB

Virtual Size

134KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-27_8a2a1aed6f21eaee672b510cb4d35c70_cobalt-strike_hijackloader_icedid_njrat

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

generic