2026-09-04_70b3e0acc54c4a6a849cd19858a48a7d_cobalt-strike_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_70b3e0acc54c4a6a849cd19858a48a7d_cobalt-strike_icedid_njrat_stealc
Size 386KB
Sample260905-h1c3vswwbs
SHA256 572825850b00f2afc0559ffb12db620c59e89fff411b092e9f19f3d9968a5e3a
MD5 70b3e0acc54c4a6a849cd19858a48a7d
SHA1 8dfdcf7bd38cef65ea5d4d9c9ace1c8528f30d4c
SHA512 1ad302793a3f1252fc64ed8c85e0e2a809e7b20279fc370608577c01e89bd2bc28d55af92161e611b46512c56178109b3e2996b232eaba08ea4ef4b0fe1e6af1
SSDEEP 6144:055Fz5IY9bMEJ/q0qIKt+/83Vacr6CO+nfjKXWWPg:0pz/9bMm/qoKt+SVaw6CVmB
TLSH
T1CC844A07B2A5D0EBD26682358D97D7A5B7327C124B119BEF2290736E2E337D09D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_70b3e0acc54c4a6a849cd19858a48a7d_cobalt-strike_icedid_njrat_stealc

File Explorer

2026-09-04_70b3e0acc54c4a6a849cd19858a48a7d_cobalt-strike_icedid_njrat_stealc

.exe 386KB

2026-09-04_70b3e0acc54c4a6a849cd19858a48a7d_cobalt-strike_icedid_njrat_stealc

IMPHASH f09d3c02318a5f955bf1dbf0ee82960c
SHA256 572825850b00f2afc0559ffb12db620c59e89fff411b092e9f19f3d9968a5e3a
MD5 70b3e0acc54c4a6a849cd19858a48a7d
SHA1 8dfdcf7bd38cef65ea5d4d9c9ace1c8528f30d4c
SHA512 1ad302793a3f1252fc64ed8c85e0e2a809e7b20279fc370608577c01e89bd2bc28d55af92161e611b46512c56178109b3e2996b232eaba08ea4ef4b0fe1e6af1
SSDEEP 6144:055Fz5IY9bMEJ/q0qIKt+/83Vacr6CO+nfjKXWWPg:0pz/9bMm/qoKt+SVaw6CVmB
TLSH
T1CC844A07B2A5D0EBD26682358D97D7A5B7327C124B119BEF2290736E2E337D09D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\user\Desktop\FalconFlank\x64\Release\FalconFlank.pdb

kernel32

SetPriorityClass GetCurrentProcess WriteFile ExpandEnvironmentStringsW DeviceIoControl CreateNamedPipeW SetThreadPriority SetEndOfFile WaitForSingleObject UnmapViewOfFile CreateEventW Sleep GetLastError CreateFileTransactedW GetCurrentThread DeleteFileW CloseHandle GetProcAddress GetModuleHandleW CreateFileMappingW MapViewOfFile ConnectNamedPipe FlushFileBuffers WriteConsoleW CreateFileW HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW

ole32

CoCreateGuid CoInitialize StringFromCLSID CoUninitialize CoCreateInstance

oleaut32

VariantClear VariantInit

ntdll

RtlInitUnicodeString NtCreateFile

ktmw32

CommitTransaction CreateTransaction

Name

.text

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

230KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_70b3e0acc54c4a6a849cd19858a48a7d_cobalt-strike_icedid_njrat_stealc

kernel32

ole32

oleaut32

ntdll

ktmw32

generic