2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos

General

Target
2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos
Size 3.6MB
Sample260731-c716dasbrf
SHA256 daed5092a7820efbc99024dc7caa5d5199db2333b5791c9500f6eca00778b87f
MD5 a3eba7c4b40eb37574191b9ea90634d1
SHA1 31dbbe596505528a6028d98ab5abf0c0a22e1479
SHA512 bf3b5dedce96ddc99e53585639af977fa218a5a669ff66287a685641d4a0dc94fb3ca80f43e1c37fc1fbbe7c0773d4e2ca014194293a234d5290ac18faf2a9b7
SSDEEP 49152:aWGfi7UpHn+XBttX3As2cUEfeDWmPKVtBX8mvcXd/5mJKlvDlpiGgSmVJJXA:L7VOZJnx5fiSmVL
TLSH
T10906F105A6C512B9C06BC578C28B0A1FE761708B57669EEF06C169423F63FF25F39329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos

File Explorer

2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos

.exe 3.6MB

2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos

IMPHASH 4121250e049602b9dbc4deeaf7a1f2be
SHA256 daed5092a7820efbc99024dc7caa5d5199db2333b5791c9500f6eca00778b87f
MD5 a3eba7c4b40eb37574191b9ea90634d1
SHA1 31dbbe596505528a6028d98ab5abf0c0a22e1479
SHA512 bf3b5dedce96ddc99e53585639af977fa218a5a669ff66287a685641d4a0dc94fb3ca80f43e1c37fc1fbbe7c0773d4e2ca014194293a234d5290ac18faf2a9b7
SSDEEP 49152:aWGfi7UpHn+XBttX3As2cUEfeDWmPKVtBX8mvcXd/5mJKlvDlpiGgSmVJJXA:L7VOZJnx5fiSmVL
TLSH
T10906F105A6C512B9C06BC578C28B0A1FE761708B57669EEF06C169423F63FF25F39329
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

751840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

inet_pton ntohl

bcrypt

BCryptGenRandom

kernel32

AreFileApisANSI CloseHandle CompareStringW CreateFile2 CreateFileW CreateProcessW DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LocalFree MoveFileExW MultiByteToWideChar QueryPerformanceCounter RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_a3eba7c4b40eb37574191b9ea90634d1_cobalt-strike_icedid_njrat_remcos

ws2_32

bcrypt

kernel32

generic