2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat
Size 808KB
Sample260913-lsv59aaa47
SHA256 62ba9639ef75606548755a259103e83f0ec1464b0f05c6f02fe5e35990de02c0
MD5 d5d17b986fb728e4340968e603256974
SHA1 9752755518c4f303c2d419563be71b5d9b7a3552
SHA512 d75e661184be78b951f953c6984ee753f7d2b8359a41873c1cb7891894357250701cd26fabd69706ec261cdbcf5a836471c45a7ddad70ca83207068364566daf
SSDEEP 12288:ayzx0W0dvt5S6JMSQldt+FjFR8O3ykvS9Wug:r10WolM6JMSQIhFR8hb
TLSH
T1C0059E6167D803E2E077C27D89D98A9AE6B2B4040730ABC706E452993F33FE55E3E715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat

File Explorer

2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat

.exe 808KB

2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat

IMPHASH 19bd5af6bb3453f0095949db0b04f756
SHA256 62ba9639ef75606548755a259103e83f0ec1464b0f05c6f02fe5e35990de02c0
MD5 d5d17b986fb728e4340968e603256974
SHA1 9752755518c4f303c2d419563be71b5d9b7a3552
SHA512 d75e661184be78b951f953c6984ee753f7d2b8359a41873c1cb7891894357250701cd26fabd69706ec261cdbcf5a836471c45a7ddad70ca83207068364566daf
SSDEEP 12288:ayzx0W0dvt5S6JMSQldt+FjFR8O3ykvS9Wug:r10WolM6JMSQIhFR8hb
TLSH
T1C0059E6167D803E2E077C27D89D98A9AE6B2B4040730ABC706E452993F33FE55E3E715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

306499

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Desktop\ElitraFly_Project\ElitraFly\x64\Debug\ElitraFly.pdb

kernel32

CreateFileW ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx SetConsoleCtrlHandler WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage GetConsoleWindow GetComputerNameA GetModuleHandleW GetModuleHandleA CreateMutexA GetLastError CloseHandle GetTempPathA ReadFile WriteFile GetFileSize CreateFileA GetStringTypeW CreateDirectoryA FindNextFileW FindFirstFileExW FindClose OutputDebugStringW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetCurrentThreadId IsDebuggerPresent RaiseException MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RtlPcToFileHeader GetStdHandle GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter WaitForSingleObject GetExitCodeProcess CreateProcessW GetFileAttributesExW GetCurrentThread GetFileType GetTempPathW IsThreadAFiber VirtualProtect GetDateFormatW GetTimeFormatW RtlUnwind

user32

GetMessageW SendMessageW DefWindowProcA DispatchMessageW SendMessageA TranslateMessage PostQuitMessage BlockInput LoadIconW LoadCursorW GetDesktopWindow MessageBoxA ReleaseDC GetDC GetSystemMetrics GetDlgItemTextA ShowWindow DestroyWindow CreateWindowExA RegisterClassA

gdi32

SelectObject GetBitmapBits DeleteObject DeleteDC CreateSolidBrush CreateFontA CreateCompatibleDC CreateCompatibleBitmap BitBlt

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA

shell32

SHGetFolderPathA

wininet

InternetOpenA InternetCloseHandle InternetConnectA InternetOpenUrlA InternetReadFile HttpOpenRequestA HttpSendRequestA

Name

.textbss

Size

Virtual Size

288KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

632KB

Virtual Size

632KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

481B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-13_d5d17b986fb728e4340968e603256974_cobalt-strike_icedid_njrat

kernel32

user32

gdi32

advapi32

shell32

wininet

generic