2026-09-04_8925e608a14b764292b3f8e173683c94_cobalt-strike_icedid_njrat_stealc

General

Target
2026-09-04_8925e608a14b764292b3f8e173683c94_cobalt-strike_icedid_njrat_stealc
Size 941KB
Sample260905-e13rqsttay
SHA256 b6f16644686ab37633e8c57077399d439eb76923b059937f2fcd09f3afe2988c
MD5 8925e608a14b764292b3f8e173683c94
SHA1 991ad54246cd033fe9b5a8cfa48c8824f4a47f6e
SHA512 482dd0aa0403926642d6256210cbbbc98e88c3987b6ee53734ff04dee16323f38704a6daaee9acb65a9b237855d525deed5668969a6d4ce34ad6e48b3554c970
SSDEEP 24576:rMLbqXXVB30EQGbRv0wnO2yXAFHFiGnccDtv5f:rIGv3x0wO9wFHkGnHxf
TLSH
T1EA25BE4AF2F940F9D037A135C997560BEB72781907605ADF13E40AA92FB37E05A7B312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_8925e608a14b764292b3f8e173683c94_cobalt-strike_icedid_njrat_stealc

File Explorer

2026-09-04_8925e608a14b764292b3f8e173683c94_cobalt-strike_icedid_njrat_stealc

.exe 941KB

2026-09-04_8925e608a14b764292b3f8e173683c94_cobalt-strike_icedid_njrat_stealc

IMPHASH 058cef60151f84b169cabda46d621319
SHA256 b6f16644686ab37633e8c57077399d439eb76923b059937f2fcd09f3afe2988c
MD5 8925e608a14b764292b3f8e173683c94
SHA1 991ad54246cd033fe9b5a8cfa48c8824f4a47f6e
SHA512 482dd0aa0403926642d6256210cbbbc98e88c3987b6ee53734ff04dee16323f38704a6daaee9acb65a9b237855d525deed5668969a6d4ce34ad6e48b3554c970
SSDEEP 24576:rMLbqXXVB30EQGbRv0wnO2yXAFHFiGnccDtv5f:rIGv3x0wO9wFHkGnHxf
TLSH
T1EA25BE4AF2F940F9D037A135C997560BEB72781907605ADF13E40AA92FB37E05A7B312
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SizeofResource Process32First WriteProcessMemory WriteFile FindResourceA WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Sleep GetTempPathA GetLastError CreateFileA LockResource DeleteFileA Process32Next CloseHandle LoadResource GetProcAddress VirtualAllocEx CreateRemoteThread VirtualFreeEx GetTickCount WriteConsoleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap SetFilePointerEx ReadFile ReadConsoleW GetFileSizeEx HeapSize HeapReAlloc CreateFileW RtlUnwind

Name

.text

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

788KB

Virtual Size

787KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_8925e608a14b764292b3f8e173683c94_cobalt-strike_icedid_njrat_stealc

kernel32

generic