2026-08-27_a413eac8a04f2dd0687cb637035a2da9_cobalt-strike_icedid_njrat_stealc

General

Target
2026-08-27_a413eac8a04f2dd0687cb637035a2da9_cobalt-strike_icedid_njrat_stealc
Size 216KB
Sample260827-nfbxysgn21
SHA256 503b332f939843ea91e0bb90002638b9e5da466bb647fa0378c53723658ecf1e
MD5 a413eac8a04f2dd0687cb637035a2da9
SHA1 4218c7105045a955b2524a4f8685dfefb2c4c7ae
SHA512 bfdcc224abd3af4b4801652d70ac88d1487d60c91acd46cfb8a05ddcdf8d80a56af146c65b9e73c4dc9505a19e6ddd6b68e4f9353fc41970098a22993e2043f5
SSDEEP 3072:eLbu5tf43sX++V6svXaZ2WijP21UqaaXkb9SI74mrj:eLK5t8sO+IsSZ26ik
TLSH
T1A0249E09B7E658FEE16BC579CC520946EA727C4503A0DBDF03900AD69F636E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_a413eac8a04f2dd0687cb637035a2da9_cobalt-strike_icedid_njrat_stealc

File Explorer

2026-08-27_a413eac8a04f2dd0687cb637035a2da9_cobalt-strike_icedid_njrat_stealc

.exe 216KB

2026-08-27_a413eac8a04f2dd0687cb637035a2da9_cobalt-strike_icedid_njrat_stealc

IMPHASH edd2d0260e0284113484d4216a1c016d
SHA256 503b332f939843ea91e0bb90002638b9e5da466bb647fa0378c53723658ecf1e
MD5 a413eac8a04f2dd0687cb637035a2da9
SHA1 4218c7105045a955b2524a4f8685dfefb2c4c7ae
SHA512 bfdcc224abd3af4b4801652d70ac88d1487d60c91acd46cfb8a05ddcdf8d80a56af146c65b9e73c4dc9505a19e6ddd6b68e4f9353fc41970098a22993e2043f5
SSDEEP 3072:eLbu5tf43sX++V6svXaZ2WijP21UqaaXkb9SI74mrj:eLK5t8sO+IsSZ26ik
TLSH
T1A0249E09B7E658FEE16BC579CC520946EA727C4503A0DBDF03900AD69F636E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

37272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileW CloseHandle DeviceIoControl Sleep GetCurrentProcessId VirtualAlloc VirtualFree K32EnumDeviceDrivers K32GetDeviceDriverBaseNameA WriteConsoleW HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap SetEnvironmentVariableW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InitializeSListHead GetCurrentProcess TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW

ws2_32

getaddrinfo WSACleanup WSAStartup socket freeaddrinfo send select recv connect closesocket setsockopt

Name

.text

Size

137KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

3KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_a413eac8a04f2dd0687cb637035a2da9_cobalt-strike_icedid_njrat_stealc

kernel32

ws2_32

generic