2026-07-28_dfd2a6c1f366cad2ec44e3b25ba11157_cobalt-strike_icedid_njrat

General

Target
2026-07-28_dfd2a6c1f366cad2ec44e3b25ba11157_cobalt-strike_icedid_njrat
Size 375KB
Sample260728-mq22fsvbmd
SHA256 339930a4e7d353145e34308ac339f3a27201553fd8e235729b504569fe3b8a7c
MD5 dfd2a6c1f366cad2ec44e3b25ba11157
SHA1 59fa35b4fae0a44a24a9f598f2b9200413571edc
SHA512 49a15a30c3ac52555a766f7fa32bcb6128193521af3d318c31ed46b17c45d75e0280e2086bfc96eb24a73180e5fc187073237c5fb9cb4f5bb2476176431cc65c
SSDEEP 6144:e9Uiae7W1ziXhDgKpAbN2aQWoH4cw3IT9W0:e9dV7W1ziXhDgKpAR0TU0
TLSH
T10784A45AFBF610E4E5BAC13895A2312AFC7138A54738EBD79685460B1B30BE4ED3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-28_dfd2a6c1f366cad2ec44e3b25ba11157_cobalt-strike_icedid_njrat

File Explorer

2026-07-28_dfd2a6c1f366cad2ec44e3b25ba11157_cobalt-strike_icedid_njrat

.exe 375KB

2026-07-28_dfd2a6c1f366cad2ec44e3b25ba11157_cobalt-strike_icedid_njrat

IMPHASH e497fb5571a7f5cde13bf6da110e6cf0
SHA256 339930a4e7d353145e34308ac339f3a27201553fd8e235729b504569fe3b8a7c
MD5 dfd2a6c1f366cad2ec44e3b25ba11157
SHA1 59fa35b4fae0a44a24a9f598f2b9200413571edc
SHA512 49a15a30c3ac52555a766f7fa32bcb6128193521af3d318c31ed46b17c45d75e0280e2086bfc96eb24a73180e5fc187073237c5fb9cb4f5bb2476176431cc65c
SSDEEP 6144:e9Uiae7W1ziXhDgKpAbN2aQWoH4cw3IT9W0:e9dV7W1ziXhDgKpAR0TU0
TLSH
T10784A45AFBF610E4E5BAC13895A2312AFC7138A54738EBD79685460B1B30BE4ED3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WriteProcessMemory CreateToolhelp32Snapshot CloseHandle VirtualProtectEx VirtualAllocEx ReadProcessMemory VirtualFreeEx VirtualFree VirtualAlloc Module32First CreateFileW OpenProcess Sleep LoadLibraryW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx HeapQueryInformation HeapReAlloc HeapFree GetStringTypeW SetStdHandle GetProcessHeap EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetModuleFileNameW GetModuleHandleExW ExitProcess GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapSize HeapValidate GetSystemInfo GetFileType OutputDebugStringW WriteConsoleW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW

user32

FindWindowA UnhookWindowsHookEx SetWindowsHookExA PostThreadMessageA GetWindowThreadProcessId

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlImageNtHeader

Name

.text

Size

269KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_dfd2a6c1f366cad2ec44e3b25ba11157_cobalt-strike_icedid_njrat

kernel32

user32

ntdll

generic