2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat
Size 8.5MB
Sample260905-xt7ffsgr9v
SHA256 931fe488bc4eabb5b7ad1a5566e675b0c4e72dad9edd973f87a32167e715d690
MD5 087711001fd83790aeee5624f683e853
SHA1 2c95ba7bf9623051aa27e11177371ebe5fd3d0aa
SHA512 19651cd72eb9dec6ecc945aaf4e6c800235b0e4486f9888728f050bdd1e70343003fe83a5dffba38878ccf3705dc5f685d82a63d5e7b33663031e8e1c7b0c94b
SSDEEP 98304:Uh/tz1kqApyvB+0A87IlF1oekyXQFCDfU2rTZmwwrdvtFGcRu:Uv+qApyvBRWaekIrDvrTlUJbRu
TLSH
T15796E0AEE14DEFC9E017133ED5407EB262DD45299F906CEB60894C481EAFEC9583A34D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat

File Explorer

2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat

.exe 8.5MB

2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat

IMPHASH 1395ec9a38891f42e5c22426373f8b85
SHA256 931fe488bc4eabb5b7ad1a5566e675b0c4e72dad9edd973f87a32167e715d690
MD5 087711001fd83790aeee5624f683e853
SHA1 2c95ba7bf9623051aa27e11177371ebe5fd3d0aa
SHA512 19651cd72eb9dec6ecc945aaf4e6c800235b0e4486f9888728f050bdd1e70343003fe83a5dffba38878ccf3705dc5f685d82a63d5e7b33663031e8e1c7b0c94b
SSDEEP 98304:Uh/tz1kqApyvB+0A87IlF1oekyXQFCDfU2rTZmwwrdvtFGcRu:Uv+qApyvBRWaekIrDvrTlUJbRu
TLSH
T15796E0AEE14DEFC9E017133ED5407EB262DD45299F906CEB60894C481EAFEC9583A34D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14081

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ralzy.DESKTOP-9N3HG7H.000\Documents\desktop\RALZY\R4L_External_Source\R4L\build\R4L_Loader.pdb

kernel32

CreateFileA DeleteFileA GetFileAttributesA WriteFile GetTempPathA CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap WaitForSingleObject Sleep GetCurrentProcessId GetExitCodeProcess CreateProcessA GetTickCount GetTickCount64 LoadResource LockResource SizeofResource FindResourceA WriteConsoleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetCurrentThread GetFileType OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTempPathW IsThreadAFiber VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW SetConsoleCtrlHandler CreateFileW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc SetEndOfFile ReadFile ReadConsoleW RtlUnwind

Name

.text

Size

605KB

Virtual Size

605KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7.8MB

Virtual Size

7.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_087711001fd83790aeee5624f683e853_cobalt-strike_icedid_njrat

kernel32

generic