2026-08-13_968534585486239658e3e26c704967af_cobalt-strike_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-13_968534585486239658e3e26c704967af_cobalt-strike_icedid_njrat
Size 1.8MB
Sample260813-era1cs1fmc
SHA256 89594e3d177530db018d8c51fa90f0b626490740e6ea59bc44e945951cac5032
MD5 968534585486239658e3e26c704967af
SHA1 ab1d207efc3ed112c079b6a767464268c3aac83f
SHA512 a7200690faf5647407cc59ab2362168871b987ff327c6155857912c23bafb2d8d4cbe9e888ba1cc49f9b164860c20110f8bb2fe4ec374b23b5cc3b5d41e564d7
SSDEEP 24576:2apn8h7LRFSgDH549BD/fR1S04yZ1/6Vr9vH:JEVfCBD/lDm
TLSH
T113859D3632AC0085E176C13DC98A474ADEB1741A033956EB4296CADD2F67BFD4F3E621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-13_968534585486239658e3e26c704967af_cobalt-strike_icedid_njrat

File Explorer

2026-08-13_968534585486239658e3e26c704967af_cobalt-strike_icedid_njrat

.exe 1.8MB

2026-08-13_968534585486239658e3e26c704967af_cobalt-strike_icedid_njrat

IMPHASH 6ee2b4b6e04b296d2a8d27e86f11e1d9
SHA256 89594e3d177530db018d8c51fa90f0b626490740e6ea59bc44e945951cac5032
MD5 968534585486239658e3e26c704967af
SHA1 ab1d207efc3ed112c079b6a767464268c3aac83f
SHA512 a7200690faf5647407cc59ab2362168871b987ff327c6155857912c23bafb2d8d4cbe9e888ba1cc49f9b164860c20110f8bb2fe4ec374b23b5cc3b5d41e564d7
SSDEEP 24576:2apn8h7LRFSgDH549BD/fR1S04yZ1/6Vr9vH:JEVfCBD/lDm
TLSH
T113859D3632AC0085E176C13DC98A474ADEB1741A033956EB4296CADD2F67BFD4F3E621
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

717799

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Jking\source\repos\ConsoleApplication6\x64\Debug\ConsoleApplication6.pdb

kernel32

HeapSize CreateFileW SetStdHandle SetEnvironmentVariableW WriteConsoleW GetEnvironmentStringsW OutputDebugStringW GetTimeZoneInformation HeapReAlloc SetEndOfFile FreeEnvironmentStringsW LocalFree SetConsoleCtrlHandler GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile FormatMessageA GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileAttributesW SetFileInformationByHandle SetFileTime GetTempPathW CreateFile2 AreFileApisANSI CloseHandle GetLastError DeviceIoControl GetModuleHandleW GetProcAddress CreateDirectoryExW CopyFile2 MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo GetCurrentThreadId IsDebuggerPresent RaiseException QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter IsThreadAFiber VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetCurrentThread FlushFileBuffers GetConsoleOutputCP GetConsoleMode RtlUnwind

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpQueryHeaders WinHttpReceiveResponse

crypt32

CryptStringToBinaryA CryptUnprotectData

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey

Name

.textbss

Size

Virtual Size

690KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

237KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

620B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-13_968534585486239658e3e26c704967af_cobalt-strike_icedid_njrat

kernel32

winhttp

crypt32

bcrypt

generic