2026-09-26_5896e88cfe8764a1f8fc63bfdea159f3_cobalt-strike_icedid_njrat

General

Target
2026-09-26_5896e88cfe8764a1f8fc63bfdea159f3_cobalt-strike_icedid_njrat
Size 862KB
Sample260926-2cq5csvxay
SHA256 4cf701f4d988799484d719772378422d634ba3107bfb4c26ed0f96afbbb9177d
MD5 5896e88cfe8764a1f8fc63bfdea159f3
SHA1 cf01504f06ae5df4184df3b967b7cda773f199d3
SHA512 454ecb7799db6792ccc26ea28371554a1135ecbd357e2c89fcb7b920876c431a6b6238a31ae536a6ac554f05de0b4a083f4f4f7ce8d9a13253bae45a8b37d31a
SSDEEP 12288:zR4P8vfHB1CMLtVflYHF3u+hpUkqSFz2lqESRHgdP5FV6hPJhfgLhbD1jNE:zR3WmtMFlrnFKlqtHTJhfot1jNE
TLSH
T1B015E007A2B508F5E8BAC33B85117116B5B2B88527B4EFEB9345192F5F636E0783D381
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-09-26_5896e88cfe8764a1f8fc63bfdea159f3_cobalt-strike_icedid_njrat

File Explorer

2026-09-26_5896e88cfe8764a1f8fc63bfdea159f3_cobalt-strike_icedid_njrat

.exe 862KB

2026-09-26_5896e88cfe8764a1f8fc63bfdea159f3_cobalt-strike_icedid_njrat

IMPHASH 8e0f7226699c655296bdb5c03b3ebef1
SHA256 4cf701f4d988799484d719772378422d634ba3107bfb4c26ed0f96afbbb9177d
MD5 5896e88cfe8764a1f8fc63bfdea159f3
SHA1 cf01504f06ae5df4184df3b967b7cda773f199d3
SHA512 454ecb7799db6792ccc26ea28371554a1135ecbd357e2c89fcb7b920876c431a6b6238a31ae536a6ac554f05de0b4a083f4f4f7ce8d9a13253bae45a8b37d31a
SSDEEP 12288:zR4P8vfHB1CMLtVflYHF3u+hpUkqSFz2lqESRHgdP5FV6hPJhfgLhbD1jNE:zR3WmtMFlrnFKlqtHTJhfot1jNE
TLSH
T1B015E007A2B508F5E8BAC33B85117116B5B2B88527B4EFEB9345192F5F636E0783D381
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

3d:19:47:1e:0d:33:49:7d:12:81:fe:ea:ae:cb:e7:ca:8f:92:45:c0

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=LENOVO,O=LENOVO,L=Morrisville,ST=North Carolina,C=US

Chains

Jul 7, 2015

CN=LENOVO,O=LENOVO,L=Morrisville,ST=North Carolina,C=US

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 5, 2015 - Dec 31, 2015

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=LENOVO,O=LENOVO,L=Morrisville,ST=North Carolina,C=US

Serial Number

57:16:18:0d:b7:d4:98:9d:c4:a1:70:83:dc:fa:75:67

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 13, 2015 - Jan 12, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

0

Major OS version

6

Entry point

69716

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileA SetFilePointer WriteFile GetTempPathA IsDebuggerPresent CloseHandle InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentProcess GetCurrentProcessId ExitProcess GetCurrentThread GetCurrentThreadId ProcessIdToSessionId GetTickCount VirtualAlloc VirtualProtect GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryA CopyFileA WriteConsoleW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread GetSystemTimeAsFileTime GetModuleHandleW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EncodePointer DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetModuleFileNameW GetStdHandle HeapFree HeapAlloc GetFileType LCMapStringW SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-26_5896e88cfe8764a1f8fc63bfdea159f3_cobalt-strike_icedid_njrat

PE Signature issue

kernel32

generic