2026-08-10_70a03a45f491020e931688637a93c998_akira_cobalt-strike_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_70a03a45f491020e931688637a93c998_akira_cobalt-strike_icedid_njrat
Size 633KB
Sample260810-fb6yja1eqe
SHA256 36c7457a553d57df1fa3c796bbd8131847bd1fb3555cb1b7bb91f7fc63dee719
MD5 70a03a45f491020e931688637a93c998
SHA1 c2d5d96d848a655f3534d6c2d5fb99b66993925b
SHA512 f7471311e34546f84eb71409cf78024df560438ee31785be1d66c4ca342e89057be1f2471d6967a27b414561c9eed816b8ca609831d8e55421a8f56ed8155a1b
SSDEEP 6144:9nHBxQmk64UIqgBH5sqG1YouOYEmy3C5wzfXocgbj1cw40kYbbzTZ9Y9YXixi2Yp:9nd7aZsBYHRE2
TLSH
T11BD4085AA6A443E5D0BAD0388A42E13AF9717C96473087CB56D07E573F37BE19A3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_70a03a45f491020e931688637a93c998_akira_cobalt-strike_icedid_njrat

File Explorer

2026-08-10_70a03a45f491020e931688637a93c998_akira_cobalt-strike_icedid_njrat

.exe 633KB

2026-08-10_70a03a45f491020e931688637a93c998_akira_cobalt-strike_icedid_njrat

IMPHASH aa64788f82796dca304fe71ad659e867
SHA256 36c7457a553d57df1fa3c796bbd8131847bd1fb3555cb1b7bb91f7fc63dee719
MD5 70a03a45f491020e931688637a93c998
SHA1 c2d5d96d848a655f3534d6c2d5fb99b66993925b
SHA512 f7471311e34546f84eb71409cf78024df560438ee31785be1d66c4ca342e89057be1f2471d6967a27b414561c9eed816b8ca609831d8e55421a8f56ed8155a1b
SSDEEP 6144:9nHBxQmk64UIqgBH5sqG1YouOYEmy3C5wzfXocgbj1cw40kYbbzTZ9Y9YXixi2Yp:9nd7aZsBYHRE2
TLSH
T11BD4085AA6A443E5D0BAD0388A42E13AF9717C96473087CB56D07E573F37BE19A3E700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

209540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\weasel-hd2-private\weasel-hd2-private\output\WeaselDeployer.pdb

rime

rime_get_api

kernel32

FindResourceExW GetThreadUILanguage SetLastError EnterCriticalSection LeaveCriticalSection GetCurrentThreadId DeleteCriticalSection InitializeCriticalSectionEx OutputDebugStringW CreateDirectoryW DecodePointer GetSystemWow64DirectoryW ExitProcess WaitForSingleObject FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW LoadLibraryExW SetThreadUILanguage SetThreadLocale FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW FindResourceW GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetConsoleMode GetConsoleOutputCP SetFilePointerEx CreateMutexW GetFileType GetStdHandle VirtualQuery VirtualProtect GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetCommandLineA CloseHandle GetFileAttributesW GetUserDefaultUILanguage GetLastError WideCharToMultiByte MultiByteToWideChar RaiseException SizeofResource LockResource LoadResource GetModuleFileNameW ExpandEnvironmentStringsW InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive SleepConditionVariableSRW SetEndOfFile WriteConsoleW ReadConsoleW GetSystemInfo TlsFree TlsSetValue TlsGetValue TlsAlloc OpenEventA WaitForSingleObjectEx ReleaseSemaphore ResetEvent GetSystemTimeAsFileTime GetCurrentProcessId SetStdHandle QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter GetFileSizeEx RtlUnwind FormatMessageA FormatMessageW LocalFree CreateEventA SetEvent GetModuleHandleExW WaitNamedPipeW SetNamedPipeHandleState CreateFileW WriteFile FlushFileBuffers DisconnectNamedPipe ReadFile IsDebuggerPresent EncodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList GetCurrentProcess FlushInstructionCache VirtualAlloc VirtualFree LoadLibraryExA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx GetStringTypeW LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter

user32

MapWindowPoints GetClientRect GetParent GetWindowRect GetMonitorInfoW EnableWindow GetWindowLongW GetWindow BringWindowToTop EndDialog GetDlgItem SetWindowLongPtrW DialogBoxParamW SetWindowPos UnregisterClassW MessageBoxExW GetActiveWindow MonitorFromWindow SendMessageW MessageBoxW LoadStringW DestroyWindow CharNextW GetKeyState CallWindowProcW GetWindowLongPtrW DefWindowProcW SetWindowTextW

gdi32

GetObjectW CreateCompatibleDC SetDIBColorTable SelectObject DeleteObject DeleteDC CreateDIBSection

advapi32

RegEnumKeyExW GetUserNameW RegQueryValueExW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegDeleteKeyW RegGetValueW RegCloseKey

shell32

ShellExecuteExW ord155 SHOpenFolderAndSelectItems ord190

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize CoInitialize

oleaut32

VarUI4FromStr

gdiplus

GdiplusShutdown GdipDrawImageI GdipDeleteGraphics GdipGetImageGraphicsContext GdipDisposeImage GdipFree GdipAlloc GdipCloneImage GdipCreateBitmapFromScan0 GdipBitmapUnlockBits GdipBitmapLockBits GdipGetImagePalette GdipGetImagePaletteSize GdipGetImageWidth GdipGetImagePixelFormat GdipCreateBitmapFromFile GdipCreateBitmapFromFileICM GdiplusStartup GdipGetImageHeight

comctl32

InitCommonControlsEx

??0?$codecvt_null@_W@archive@boost@@QEAA@_K@Z ??0?$singleton@V?$extended_type_info_typeid@UCandidateInfo@weasel@@@serialization@boost@@@serialization@boost@@IEAA@XZ ??0?$singleton@V?$extended_type_info_typeid@UText@weasel@@@serialization@boost@@@serialization@boost@@IEAA@XZ ??0?$singleton@V?$extended_type_info_typeid@UTextAttribute@weasel@@@serialization@boost@@@serialization@boost@@IEAA@XZ ??0?$singleton@V?$extended_type_info_typeid@UTextRange@weasel@@@serialization@boost@@@serialization@boost@@IEAA@XZ ??0?$singleton@V?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@IEAA@XZ ??0?$singleton@V?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@IEAA@XZ ??1?$codecvt_null@_W@archive@boost@@UEAA@XZ ??_F?$codecvt_null@_W@archive@boost@@QEAAXXZ ?do_always_noconv@?$codecvt_null@_W@archive@boost@@EEBA_NXZ ?do_encoding@?$codecvt_null@_W@archive@boost@@EEBAHXZ ?do_in@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?do_max_length@?$codecvt_null@_W@archive@boost@@EEBAHXZ ?do_out@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UCandidateInfo@weasel@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@UCandidateInfo@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UText@weasel@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@UText@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UTextAttribute@weasel@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@UTextAttribute@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@UTextRange@weasel@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@UTextRange@weasel@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vtext_wiarchive@archive@boost@@UText@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@weasel@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEBV?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ ?get_mutable_instance@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEAV?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?is_destroyed@?$singleton@V?$map@Vtext_wiarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_locked@singleton_module@serialization@boost@@QEAA_NXZ ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UCandidateInfo@weasel@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UText@weasel@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UTextAttribute@weasel@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@UTextRange@weasel@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UText@weasel@@V?$allocator@UText@weasel@@@std@@@std@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z ?load_object_data@?$iserializer@Vtext_wiarchive@archive@boost@@V?$vector@UTextAttribute@weasel@@V?$allocator@UTextAttribute@weasel@@@std@@@std@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z ?lock@?1??get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ@4_NA ?lock@singleton_module@serialization@boost@@QEAAXXZ ?unlock@singleton_module@serialization@boost@@QEAAXXZ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_70a03a45f491020e931688637a93c998_akira_cobalt-strike_icedid_njrat

rime

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

gdiplus

comctl32

generic