2026-08-22_b2af0a1cdf3d4c74d39e137a50fed78c_cobalt-strike_icedid_njrat

General

Target
2026-08-22_b2af0a1cdf3d4c74d39e137a50fed78c_cobalt-strike_icedid_njrat
Size 707KB
Sample260822-d72btaep4x
SHA256 61101459047b0b91fbfece02a68add9a750288b420351951b6b50f1138fd48be
MD5 b2af0a1cdf3d4c74d39e137a50fed78c
SHA1 bf89076357a9e1fb020bbb5964a7ca191c2fc24a
SHA512 ad06fbbd11d49ad0c64befa1d7a5f7f2cda681cefd30979c9ed4e89adca5da7a816f02a5985d99a87a683b396dc3cd39c0d583538a74debfbb9a27dc733adaf4
SSDEEP 12288:iP0bzdwU8/k3ZrEtURqwxUehiXhd3XxNi94PoeZX4:U0bpw7+ZE+RqB3XWa3ZX4
TLSH
T1A8F4E71AFAF611E4F5B6C13999A2312AFD72786547389BDB4680460B0F31FE4AD3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-22_b2af0a1cdf3d4c74d39e137a50fed78c_cobalt-strike_icedid_njrat

File Explorer

2026-08-22_b2af0a1cdf3d4c74d39e137a50fed78c_cobalt-strike_icedid_njrat

.exe 707KB

2026-08-22_b2af0a1cdf3d4c74d39e137a50fed78c_cobalt-strike_icedid_njrat

IMPHASH 89b54717c76f847f419e5fcdfbd2169a
SHA256 61101459047b0b91fbfece02a68add9a750288b420351951b6b50f1138fd48be
MD5 b2af0a1cdf3d4c74d39e137a50fed78c
SHA1 bf89076357a9e1fb020bbb5964a7ca191c2fc24a
SHA512 ad06fbbd11d49ad0c64befa1d7a5f7f2cda681cefd30979c9ed4e89adca5da7a816f02a5985d99a87a683b396dc3cd39c0d583538a74debfbb9a27dc733adaf4
SSDEEP 12288:iP0bzdwU8/k3ZrEtURqwxUehiXhd3XxNi94PoeZX4:U0bpw7+ZE+RqB3XWa3ZX4
TLSH
T1A8F4E71AFAF611E4F5B6C13999A2312AFD72786547389BDB4680460B0F31FE4AD3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

121488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\nnnnd\Desktop\kdmapper_win11\x64\Release\kdmapper.pdb

kernel32

CreateFileW GetCurrentThreadId GetModuleHandleA HeapSize GetLastError HeapReAlloc CloseHandle RaiseException HeapAlloc InitializeCriticalSectionEx GetProcAddress DeleteCriticalSection GetCurrentProcessId GetProcessHeap SetUnhandledExceptionFilter GetTempPathW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW VirtualAlloc DeviceIoControl VirtualFree SetLastError DecodePointer HeapFree GetEnvironmentStringsW GetOEMCP GetACP MultiByteToWideChar FormatMessageA GetStringTypeW WideCharToMultiByte LocalFree FindClose FindFirstFileExW FindNextFileW GetFileAttributesExW SetEndOfFile SetFilePointerEx AreFileApisANSI GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleFileNameW GetModuleHandleExW DeleteFileW HeapValidate GetSystemInfo ExitProcess GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetFileType WriteConsoleW GetFileSizeEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapQueryInformation FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW IsValidCodePage RtlUnwind

advapi32

RegCloseKey RegDeleteKeyW RegCreateKeyW RegOpenKeyW RegSetKeyValueW

ntdll

NtQuerySystemInformation RtlInitUnicodeString

Name

.text

Size

484KB

Virtual Size

484KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

189KB

Virtual Size

188KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-22_b2af0a1cdf3d4c74d39e137a50fed78c_cobalt-strike_icedid_njrat

kernel32

advapi32

ntdll

generic