2026-09-24_7be27f77053e4ab02806163e45ed08ae_cobalt-strike_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-24_7be27f77053e4ab02806163e45ed08ae_cobalt-strike_icedid_njrat
Size 155KB
Sample260925-hchnfavtdv
SHA256 0436014351f18643ed65e3ab22007b4cdc63d640a1ebc62a04cf58d16406aa3b
MD5 7be27f77053e4ab02806163e45ed08ae
SHA1 63d146d3e19f5339e7ecd0bfbbf073ebc4a0269e
SHA512 cfa9bf1b7c65cdd3dae376366fa81c7897f1127999d3573c07451d4a4cfdf132afb3b28bb9b99a21960f4c8d9e2730e932ae5ceb6883c7a1bab6d776ddb57cfa
SSDEEP 3072:Yqk0pWxh3zY7zdrPziQmRAjaYsbNhW4ijb/xK1LIk:+vzYPzijAzoNXif/xKx
TLSH
T1AAF3E040F26549D5E133AA39A86406067B7BBC404FA08F3B2264477ADF653C5CF3AE75
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-24_7be27f77053e4ab02806163e45ed08ae_cobalt-strike_icedid_njrat

File Explorer

2026-09-24_7be27f77053e4ab02806163e45ed08ae_cobalt-strike_icedid_njrat

.exe 155KB

2026-09-24_7be27f77053e4ab02806163e45ed08ae_cobalt-strike_icedid_njrat

SHA256 0436014351f18643ed65e3ab22007b4cdc63d640a1ebc62a04cf58d16406aa3b
MD5 7be27f77053e4ab02806163e45ed08ae
SHA1 63d146d3e19f5339e7ecd0bfbbf073ebc4a0269e
SHA512 cfa9bf1b7c65cdd3dae376366fa81c7897f1127999d3573c07451d4a4cfdf132afb3b28bb9b99a21960f4c8d9e2730e932ae5ceb6883c7a1bab6d776ddb57cfa
SSDEEP 3072:Yqk0pWxh3zY7zdrPziQmRAjaYsbNhW4ijb/xK1LIk:+vzYPzijAzoNXif/xKx
TLSH
T1AAF3E040F26549D5E133AA39A86406067B7BBC404FA08F3B2264477ADF653C5CF3AE75
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

1f:93:4f:2a:65:bd:31:33:6f:5a:c9:d1:4e:9a:d7:e2:6e:ed:1c:3d:d9:85:45:c0:fb:39:40:da:dd:fa:92:e6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=22178368,CN=MICRO-STAR INTERNATIONAL CO.\, LTD.,O=MICRO-STAR INTERNATIONAL CO.\, LTD.,STREET=NO.69\, LI-DE ST.\, ZHONGHE DIST.,L=New Taipei,ST=New Taipei,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 24, 2026

Subject

Serial Number

16:32:e2:02:76:e1:b1:b1:41:55:54:c3:81:a0:99:ef

Issuer

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 21, 2023 - Dec 19, 2026

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

2318336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.tuiwhgr

Size

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ezysver

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.hrexjqx

Size

3KB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.iocxgxr

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xfvhedo

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.uonqoed

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.hnoqohb

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.sdsujmi

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-24_7be27f77053e4ab02806163e45ed08ae_cobalt-strike_icedid_njrat

PE Signature issue

generic