2026-08-14_55d5b10e93dfec07e7aab7d5738a80c4_cobalt-strike_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-14_55d5b10e93dfec07e7aab7d5738a80c4_cobalt-strike_icedid_njrat_stealc
Size 1.1MB
Sample260814-e15akavcja
SHA256 c4f8ace7ac7db4a31c48b4107e903dca726d8d10ba70ba55312b481302aa735f
MD5 55d5b10e93dfec07e7aab7d5738a80c4
SHA1 793f3953ecd729d0e6a3406e1bc64cba2311f479
SHA512 4cd6e115492bd9e571b037a0d35e98575108d3663cf92f5619a8e607f9472a2d10b2672b8cd959b0a34e16795ca4a25fbbdb2a8b49619ceb852f948a39898d4b
SSDEEP 24576:nkCeOt7UJyCqwGCLKJkmRmLICECffSVgPCS3tMrMyj3F9hIF1SqY5cbaF:Zey7vJJdWSVE3tMx3FE1S0W
TLSH
T17B457D1576A841F8D17AD1748A974927EBB2BC06073197EF07D0AA6A2F37AF04E3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_55d5b10e93dfec07e7aab7d5738a80c4_cobalt-strike_icedid_njrat_stealc

File Explorer

2026-08-14_55d5b10e93dfec07e7aab7d5738a80c4_cobalt-strike_icedid_njrat_stealc

.exe 1.1MB

2026-08-14_55d5b10e93dfec07e7aab7d5738a80c4_cobalt-strike_icedid_njrat_stealc

IMPHASH 71bee0b030c3a6fb11526dfa9e50258e
SHA256 c4f8ace7ac7db4a31c48b4107e903dca726d8d10ba70ba55312b481302aa735f
MD5 55d5b10e93dfec07e7aab7d5738a80c4
SHA1 793f3953ecd729d0e6a3406e1bc64cba2311f479
SHA512 4cd6e115492bd9e571b037a0d35e98575108d3663cf92f5619a8e607f9472a2d10b2672b8cd959b0a34e16795ca4a25fbbdb2a8b49619ceb852f948a39898d4b
SSDEEP 24576:nkCeOt7UJyCqwGCLKJkmRmLICECffSVgPCS3tMrMyj3F9hIF1SqY5cbaF:Zey7vJJdWSVE3tMx3FE1S0W
TLSH
T17B457D1576A841F8D17AD1748A974927EBB2BC06073197EF07D0AA6A2F37AF04E3D311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

437136

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\moham\Xenos\build\x64\Release\Xenos64.pdb

shlwapi

SHDeleteKeyW SHSetValueW

dbghelp

MiniDumpWriteDump

kernel32

LoadResource FindResourceW DecodePointer GetWindowsDirectoryW DeleteCriticalSection CreateProcessW GetCurrentProcess GetModuleFileNameW WaitForSingleObject GetCurrentThreadId Sleep CreateThread GetLocalTime ExitProcess GetCurrentProcessId SetUnhandledExceptionFilter FlushFileBuffers GetFileAttributesW ResumeThread CloseHandle GetNativeSystemInfo GetModuleHandleW DeleteFileW LockResource GetLastError Wow64RevertWow64FsRedirection CreateFileW InitializeCriticalSectionEx Wow64DisableWow64FsRedirection WriteFile VirtualProtect SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindNextFileW FindFirstFileExW FindClose GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale SizeofResource GetCommandLineW DeactivateActCtx GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection MultiByteToWideChar FormatMessageW LocalFree WideCharToMultiByte DeviceIoControl GetSystemTimeAsFileTime QueryPerformanceCounter VirtualFree VirtualAlloc TerminateProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetExitCodeProcess Thread32Next Thread32First CreateActCtxW GetTempPathW UnmapViewOfFile GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile DuplicateHandle GetCurrentThread ResetEvent GetTickCount LoadLibraryW GetProcAddress FreeLibrary GetSystemInfo VirtualAllocEx VirtualFreeEx ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW RtlUnwind GetSystemWow64DirectoryW Module32FirstW GetCurrentDirectoryW ReadFile CreateNamedPipeW TerminateThread GetExitCodeThread OpenProcess IsWow64Process SuspendThread GetThreadTimes OpenThread WriteProcessMemory VirtualProtectEx GetThreadContext ReadProcessMemory CreateRemoteThread SetThreadContext VirtualQueryEx GetStringTypeW WaitForSingleObjectEx ReleaseSRWLockExclusive AcquireSRWLockExclusive EncodePointer LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW GetCPInfo GetStartupInfoW InitializeSListHead IsDebuggerPresent OutputDebugStringW RaiseException RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree ExitThread FreeLibraryAndExitThread GetModuleHandleExW IsProcessorFeaturePresent GetStdHandle RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc GetConsoleOutputCP GetConsoleMode HeapFree

user32

GetWindowTextW GetMenu CreateWindowExW DestroyIcon LoadIconW ChangeWindowMessageFilterEx EnableMenuItem wsprintfW GetMessageW CreateDialogParamW CallWindowProcW DestroyWindow MessageBoxW SetWindowLongPtrW SendMessageW EndDialog SetWindowTextW LoadAcceleratorsW ShowWindow IsWindow DispatchMessageW IsDialogMessageW TranslateAcceleratorW TranslateMessage SendMessageA GetDlgItem DialogBoxParamW EnableWindow

comdlg32

GetOpenFileNameW GetSaveFileNameW

shell32

CommandLineToArgvW DragQueryFileW

ole32

CoUninitialize CoCreateInstance CoInitialize

advapi32

RegCreateKeyW RegOpenKeyExW RegEnumValueW LookupPrivilegeValueW AdjustTokenPrivileges OpenThreadToken RegOpenKeyW OpenProcessToken RegSetValueExW RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-14_55d5b10e93dfec07e7aab7d5738a80c4_cobalt-strike_icedid_njrat_stealc

shlwapi

dbghelp

kernel32

user32

comdlg32

shell32

ole32

advapi32

generic