2026-08-04_c8e8d3d52f99cfbeddc096de2ebcd52f_cobalt-strike_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_c8e8d3d52f99cfbeddc096de2ebcd52f_cobalt-strike_icedid_njrat_stealc
Size 10.6MB
Sample260804-17wsna1gpc
SHA256 6f704fef6e7bfdc774bffd6e4a71a8e938e256af386dbcdf64fce6e6a7e28774
MD5 c8e8d3d52f99cfbeddc096de2ebcd52f
SHA1 b3a18bb5a312dc0329a827510decd493cc3ce41d
SHA512 426d55f99f101c1bbe18c09aa725a0e047ea73b9d7387881ea263060aae8e5c83c9fd9c6a62aed85a08e3acd07dd9a64e0c6ac24a3d7bc24317adf72fbcae3ad
SSDEEP 98304:NQxNXQu3sY9JdiSSOo/Y7mgTm05AwJHE6hG1XDyp/FuDJuW:4n/ag7PAmkfWpyD
TLSH
T1AFB64EC6C276D190C1E9B23872557123EF26F85D823CA2668FF18F1576FEF50A46A708
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_c8e8d3d52f99cfbeddc096de2ebcd52f_cobalt-strike_icedid_njrat_stealc

File Explorer

2026-08-04_c8e8d3d52f99cfbeddc096de2ebcd52f_cobalt-strike_icedid_njrat_stealc

.exe 10.6MB

2026-08-04_c8e8d3d52f99cfbeddc096de2ebcd52f_cobalt-strike_icedid_njrat_stealc

IMPHASH e7a3ff3b3bc7f165e77d629f1417c66e
SHA256 6f704fef6e7bfdc774bffd6e4a71a8e938e256af386dbcdf64fce6e6a7e28774
MD5 c8e8d3d52f99cfbeddc096de2ebcd52f
SHA1 b3a18bb5a312dc0329a827510decd493cc3ce41d
SHA512 426d55f99f101c1bbe18c09aa725a0e047ea73b9d7387881ea263060aae8e5c83c9fd9c6a62aed85a08e3acd07dd9a64e0c6ac24a3d7bc24317adf72fbcae3ad
SSDEEP 98304:NQxNXQu3sY9JdiSSOo/Y7mgTm05AwJHE6hG1XDyp/FuDJuW:4n/ag7PAmkfWpyD
TLSH
T1AFB64EC6C276D190C1E9B23872557123EF26F85D823CA2668FF18F1576FEF50A46A708
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7247264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleFileNameW GlobalLock GlobalUnlock GlobalAlloc GlobalFree GetLocaleInfoA QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryA GetProcAddress FreeLibrary GetModuleHandleA QueryFullProcessImageNameA GetModuleHandleW WaitForSingleObjectEx SetConsoleCP SetConsoleOutputCP GetCommandLineW VerifyVersionInfoW VerSetConditionMask GetUserDefaultGeoName GetUserDefaultLCID HeapSize SetEndOfFile SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetTimeZoneInformation GetOEMCP GetACP IsValidCodePage HeapReAlloc SetFilePointerEx GetConsoleOutputCP EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect ReadConsoleW ReadConsoleInputW HeapAlloc UnhandledExceptionFilter IsDebuggerPresent Process32NextW RtlCaptureContext HeapFree GetFileType GetCommandLineA IsProcessorFeaturePresent FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW TerminateProcess ExitProcess OpenProcess Process32FirstW Sleep WaitForSingleObject SetWaitableTimerEx CreateWaitableTimerExW GetTickCount MoveFileExW GetTickCount64 Module32NextW GetCurrentProcess GetConsoleCP FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry ReadFile GetFileSizeEx CreateFileA FormatMessageW SetLastError GetEnvironmentVariableA GetSystemDirectoryA SleepEx InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo CompareStringEx GetStringTypeW LCMapStringEx DeleteCriticalSection Module32FirstW CreateToolhelp32Snapshot WideCharToMultiByte ReadProcessMemory VirtualQueryEx CloseHandle FlushFileBuffers WriteFile GetLastError CreateFileW GetEnvironmentVariableW SetConsoleTextAttribute SetConsoleMode GetStdHandle SetConsoleCursorPosition FillConsoleOutputAttribute FillConsoleOutputCharacterW InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection DecodePointer EncodePointer WakeAllConditionVariable WakeConditionVariable InitOnceComplete InitOnceBeginInitialize GetExitCodeThread GetConsoleScreenBufferInfo SetConsoleCursorInfo GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockShared GetConsoleCursorInfo WriteConsoleW MultiByteToWideChar GetConsoleMode RtlVirtualUnwind AcquireSRWLockExclusive ReleaseSRWLockShared FormatMessageA LocalFree GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle CreateFile2 AreFileApisANSI CopyFile2 GetFileInformationByHandleEx ReleaseSRWLockExclusive RtlUnwind

user32

GetSystemMetrics GetAsyncKeyState IsIconic mouse_event FindWindowW GetForegroundWindow ShowCursor SetWindowLongW GetWindowLongW SetWindowPos SetCapture keybd_event SetForegroundWindow SetFocus ReleaseCapture IsChild GetWindowThreadProcessId SetCursorPos OpenClipboard GetClipboardData CloseClipboard EmptyClipboard SetClipboardData GetKeyboardLayout SetCursor LoadCursorW GetKeyState ClientToScreen GetCursorPos ScreenToClient GetClientRect GetMessageExtraInfo TrackMouseEvent GetCapture IsWindowUnicode SetProcessDPIAware GetDC ReleaseDC MonitorFromWindow DestroyWindow UnregisterClassA GetMonitorInfoA EnumDisplaySettingsA FindWindowA PeekMessageW TranslateMessage DispatchMessageW SetWindowDisplayAffinity DefWindowProcW PostQuitMessage UpdateWindow ShowWindow UnregisterClassW SetLayeredWindowAttributes CreateWindowExW RegisterClassExW

gdi32

GetDeviceCaps CreateDCA DeleteDC

advapi32

CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegOpenKeyExA RegCloseKey RegQueryValueExA

ws2_32

send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents WSAGetLastError recv bind closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt socket WSASetLastError WSAIoctl inet_pton WSAStartup WSACleanup __WSAFDIsSet select getaddrinfo freeaddrinfo ioctlsocket

crypt32

CryptQueryObject CertGetNameStringA CertGetCertificateChain CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertCreateCertificateChainEngine CertFreeCertificateChain CertFindExtension CertFreeCertificateChainEngine

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptCloseAlgorithmProvider

d3d11

D3D11CreateDeviceAndSwapChain D3D11CreateDevice

d3dcompiler_47

D3DCompile

dwmapi

DwmFlush DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext ImmGetContext

dcomp

DCompositionCreateDevice

Name

.text

Size

7.4MB

Virtual Size

7.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

509KB

Virtual Size

543KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

151KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_c8e8d3d52f99cfbeddc096de2ebcd52f_cobalt-strike_icedid_njrat_stealc

kernel32

user32

gdi32

advapi32

ws2_32

crypt32

bcrypt

d3d11

d3dcompiler_47

dwmapi

imm32

dcomp

generic