2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos

General

Target
2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos
Size 3.6MB
Sample260805-kzeamstdka
SHA256 199bc264807eea5c175ebf9fa2bcf0455fd7a28e35e6a5f080cbe05d0eca38e2
MD5 de6c87499a58bf63452470b958bbc67b
SHA1 08e5b2b3eb811a52ddc1d46fbf97dddc6bdbbf15
SHA512 4ed7a5cb2140eabebb5bdf1198fed436c89165fe7e02aca58726e8f888716814ead2c3d1e4e29a1d86e3706703e6da1a5913a69f4be9b81f7879d753a84cb113
SSDEEP 98304:B7uj6NIB9niQsaAeqcZj4mJm9gQ6VCgO4u:Mjv+wqcutgQR4
TLSH
T16606F111A6C112BDD06BC178C2C70A5BE761708A676A8EEF15C155422FA3FF25F3A32D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos

File Explorer

2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos

.exe 3.6MB

2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos

IMPHASH 4121250e049602b9dbc4deeaf7a1f2be
SHA256 199bc264807eea5c175ebf9fa2bcf0455fd7a28e35e6a5f080cbe05d0eca38e2
MD5 de6c87499a58bf63452470b958bbc67b
SHA1 08e5b2b3eb811a52ddc1d46fbf97dddc6bdbbf15
SHA512 4ed7a5cb2140eabebb5bdf1198fed436c89165fe7e02aca58726e8f888716814ead2c3d1e4e29a1d86e3706703e6da1a5913a69f4be9b81f7879d753a84cb113
SSDEEP 98304:B7uj6NIB9niQsaAeqcZj4mJm9gQ6VCgO4u:Mjv+wqcutgQR4
TLSH
T16606F111A6C112BDD06BC178C2C70A5BE761708A676A8EEF15C155422FA3FF25F3A32D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

751840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

inet_pton ntohl

bcrypt

BCryptGenRandom

kernel32

AreFileApisANSI CloseHandle CompareStringW CreateFile2 CreateFileW CreateProcessW DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LocalFree MoveFileExW MultiByteToWideChar QueryPerformanceCounter RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-05_de6c87499a58bf63452470b958bbc67b_cobalt-strike_icedid_njrat_remcos

ws2_32

bcrypt

kernel32

generic