2026-08-03_c5f0e01327d4dca351b1b06d69c9f6d7_cobalt-strike_icedid_njrat

General

Target
2026-08-03_c5f0e01327d4dca351b1b06d69c9f6d7_cobalt-strike_icedid_njrat
Size 493KB
Sample260804-ltppvsha79
SHA256 53fd8ffd59ac97e1f15d0d75bde9d495b792867f6b54248d68b5b3d315132fb5
MD5 c5f0e01327d4dca351b1b06d69c9f6d7
SHA1 74b5516ef083b9e485f76b0d2ad576bbe75feec9
SHA512 726a7a00962fb95f320108ff624fd4522f8a504904740a7e25e1bd251012844da56ce8528400b012e924091480bee8cf1a49e3269daaa29381a4b3623486b489
SSDEEP 12288:sOpfBb1blxQQpmL1VDBXKHW/3BIeCIXO3:sO1BbFlxx4L4HARb7i
TLSH
T1C9B4E142FBC559D7D1171A348A530909EB2DBC548760DB0BB78CF57A2F26A84CF2AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-08-03_c5f0e01327d4dca351b1b06d69c9f6d7_cobalt-strike_icedid_njrat

File Explorer

2026-08-03_c5f0e01327d4dca351b1b06d69c9f6d7_cobalt-strike_icedid_njrat

.exe 493KB

2026-08-03_c5f0e01327d4dca351b1b06d69c9f6d7_cobalt-strike_icedid_njrat

IMPHASH 0ca2b4aea0fd734fa9ec6d7e73291e0d
SHA256 53fd8ffd59ac97e1f15d0d75bde9d495b792867f6b54248d68b5b3d315132fb5
MD5 c5f0e01327d4dca351b1b06d69c9f6d7
SHA1 74b5516ef083b9e485f76b0d2ad576bbe75feec9
SHA512 726a7a00962fb95f320108ff624fd4522f8a504904740a7e25e1bd251012844da56ce8528400b012e924091480bee8cf1a49e3269daaa29381a4b3623486b489
SSDEEP 12288:sOpfBb1blxQQpmL1VDBXKHW/3BIeCIXO3:sO1BbFlxx4L4HARb7i
TLSH
T1C9B4E142FBC559D7D1171A348A530909EB2DBC548760DB0BB78CF57A2F26A84CF2AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

af:7b:5f:21:7b:73:12:f5:88:9a:c7:6f:42:f6:20:56:9f:ae:65:47:16:d8:5e:61:3a:c1:14:11:f3:0e:83:82

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 12, 2025

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 19, 2025 - Jun 17, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A400-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:02:79:50:74:21:14:7d:b8:a1:00:01:00:00:02:02

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

168864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ConfigSecurityPolicy.pdb

j.3sj

ncAuhSQvjTe mMzUYHHaEILJYqTUXL wGzXNhPusjcJC wWCtJTQZWMUMqy faBadUtMTblGfl eCjINQJSpXqw pQNneCBSKHKQEgNols wjZNamZOqxqERnTkV tTOfBnBkgjLUQZxZHU nvQnItOWuUkgGv OqjjreHxDmAvmHjFFcU erJMNuxDLgXGJduyOZm jAaiVCyWDNIJrDyQ AlYtvzhNnKiJXt FoDONjmmKcTqaoxQPJxy cRqcLWOwivCdszxEisfe usCCQQenEpVKgiZptBrcDVAdIYCDiywrPScIN vSmhFakQXICnZ PKHfhuUkNqRwK DMkAyrzAbOCXZ BBYOLEpeXnQX lYZiTOsrZlkDXUsZtqdj mlXypqvzxjfUqribqgXh ezHXiDXtMQhRpDyerSYaorVa VEvKGZNtwYFXZvApMuiWGOpOdn PpUiOAYzPEGvUmOvZgDPHNfLDM XriMLlzyEgDtGeexAxYMY FIEWmgwKnIDadibnGKYgPsnE cOGKvepYaNFNqcssG AvQZbejPFjHPYiyNKc pVmtgtVVyTXf mPNYrjDaw nFubacrQSRqcDDYf AAPIoOoQJPy PgkMaDWdjdAcsMhEcI suvTJYMmHVmFGDTXIhEKBPB MeeRGHqLuIOKOi QhMDaMvslpWu MSzNvQmEEYXx whrWuXkShcNR OIunPHmQYqfjA PyCoBctiolBrMjwh DjBGwasvWjVVOY YAXqlholmIRnCMQ oWSDJRKCvLkFZSQPeMdEjjfC XwOowFbjbLmPurloCfC RhIjbOdqsGQRDYkEhNt uCgImAZaGksNKjoLmOjI czOlJhkzGAQtEx LoNoEFccdrTO ANoZvheJDElm DdHVmDcDryOKwZ yXZfCUAiN LAhJOliioyOngAuC ejVWLOMCrGPbCL RsWUueibcTvzzrI TmmXkRDOXkrohKgGSCOR KrwjCyZfzlEuBcmZyEoCOl AuTLnlrWUrdcAn EqSbxctzTJPqDddI oMCsrNlMptjPSQB ChOBDYWpJfaXoepA ioCdHKujzwzNYHK WcHvqlCEHhU BRViEQIhvXTiFLOtTGNhLzABb lJwMQGoHZTca qJOasJaswDfGsecLAdp HBnjBeroiD PEMPBouQ VoNyPdyrE YUREvqnmOYJDYgHK uKlLXpphkEjUIhAucM BciXWBNzXNGPBlTW XBeZDVmP HyCerSacsduQP NzCkeLCyfSrPGESlHf MBhBbbDLoOcuf uixksJSLdGQqlWLC BKZpCoELk joZJlALthJW MYmUQYvvBsT wfdEwdjcehLHFZYA lBrwTdFgBRWcSkoawHCvSoTOF LboRfVsCnPcRvdpsvvleZOF EwvgNVnRROmyVxKZCUM zgxaihJKiTInZtymdGp bFdyEXgiwXCYQs lLpqjfttOCRr QkLsdnyiC ELWtxtoaGmn nvALPJXyoJC TmfFjaCbvVNasabjkSqDr aEyglRGoFCDUE FekwMusTFuhj yyDqycbjCCtZBmjkNljdtRAfsoE boscRKwciMnYpb qDKAEJYa QymmgjMIRGF jyOcKvWi LuvMcmRtd disQCqqSJSL bMEVDNQJBEkQrpaCSV oXWOGOrRJrpkSCUOID tmiDGCjSUxfXTUkQRuLgwxXIDOmsyY HmFalWHUXwPnTPfzqQNvjXFNYsY rNKAXPmAWvHD ebrmIywEcbuYmtxMLTFlRxYagAz hgoYpUNNTfDxkivCeAqKNQNM SYwgOmbMBpeymMexaVJSMDF XPnipJYiFsPJZZWSgQrCCGv ParzZ TUuUfUsGLVx LUGSfwWmxqVBhOfXLekZeCAd zeUxtQapoUsllcW itRyBNlBMmHxnOwGKjYiqyBfj GpQsQJdIyOwpMYHYXORVVFH FBMNKsqBFpAuaRSHWvcXlNY fzdCCFQaTGxfQhkpRUZ zdxkaTpkfiTqTZzjkL fEZRVCONfbqsQi HsvmBAJdqUudN twOZZeJM ZVELXkiIQrB yhwlswpYisL keJGatd UYcbCJEYOOciGkfwpbogb zEGbPDArHrxg BJHugvBKixjFX ZuSHwWssixFR wyTCxMTgMzaD dkzMvERmLDztgODzMsNkPvm KrQyTCFjwURqwLGgFohECC CsgwQGoKRNledF twFROdzIeJmwpD zDoTiXrIbCfwmDjbEA raTbRuSJnqRCsOnV BUCPTmpgVgyC fvQhwzzAduHqDz UeTvhua SbjUzFBCtVF spnEPlXJgPk oWbkuutf VVtkzhSVcaN JKgtWOSYZtblEld WslXDKZtGwMDZlR rpiiVrgxdsIz NSosPkINTZH hvvKgRckXolYSpRSZuun jWVcNJmSg nUulElJv FzOqZe pXHcshebuaZBidy gLvzdnZwryNiawJaj

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_c5f0e01327d4dca351b1b06d69c9f6d7_cobalt-strike_icedid_njrat

PE Signature issue

j.3sj

generic