2026-09-30_f920300beb3e66e4b7b18b4e9da08fce_cobalt-strike_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_f920300beb3e66e4b7b18b4e9da08fce_cobalt-strike_icedid_njrat_stealc
Size 1.1MB
Sample260930-hblnps1wcs
SHA256 e6b2ed2bf8d219489d74a8f8896e4ae45d83d773a7077e275fb4c8e2499c0198
MD5 f920300beb3e66e4b7b18b4e9da08fce
SHA1 acc716a8c0874299e7e69ef10664a53d7cea7b74
SHA512 15245528f8bed178861d3d65a8d64b8a25ea7a9c46d08bfb47ce9ea63fe66386b05779a64793a4f24354694fd6976453a1dc4f586401fbef63a5e89d87b0a0f8
SSDEEP 12288:vBR94HNLMUXVmyd2SRX6Td3pnNtM/+pk0TqF8m+SKM6R:vBRytLMUXNd2SRX6Td5nDM/okyPm+
TLSH
T165357C26A75800BCD5BBD0F9CB565903EB72784603309EEB03D06AA61F279E55B3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_f920300beb3e66e4b7b18b4e9da08fce_cobalt-strike_icedid_njrat_stealc

File Explorer

2026-09-30_f920300beb3e66e4b7b18b4e9da08fce_cobalt-strike_icedid_njrat_stealc

.exe 1.1MB

2026-09-30_f920300beb3e66e4b7b18b4e9da08fce_cobalt-strike_icedid_njrat_stealc

IMPHASH 2c3d63c628b6ad9b8b47282dd3caf571
SHA256 e6b2ed2bf8d219489d74a8f8896e4ae45d83d773a7077e275fb4c8e2499c0198
MD5 f920300beb3e66e4b7b18b4e9da08fce
SHA1 acc716a8c0874299e7e69ef10664a53d7cea7b74
SHA512 15245528f8bed178861d3d65a8d64b8a25ea7a9c46d08bfb47ce9ea63fe66386b05779a64793a4f24354694fd6976453a1dc4f586401fbef63a5e89d87b0a0f8
SSDEEP 12288:vBR94HNLMUXVmyd2SRX6Td3pnNtM/+pk0TqF8m+SKM6R:vBRytLMUXNd2SRX6Td5nDM/okyPm+
TLSH
T165357C26A75800BCD5BBD0F9CB565903EB72784603309EEB03D06AA61F279E55B3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables packed with VMProtect.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

738832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

DispatchMessageW PeekMessageW GetMessageTime SendMessageA SendMessageW PostMessageA PostMessageW DefWindowProcA PostQuitMessage CallWindowProcA CallWindowProcW RegisterClassA CreateWindowExA CreateWindowExW IsWindow ShowWindow MoveWindow GetWindowPlacement SetWindowPlacement SetFocus GetFocus GetKeyState MsgWaitForMultipleObjects SetTimer KillTimer UpdateWindow GetDC ReleaseDC BeginPaint DrawTextA CharNextA MonitorFromRect SystemParametersInfoA LoadIconA GetParent SetWindowLongPtrW SetWindowLongPtrA GetWindowLongA FillRect ScreenToClient SetCursor MessageBoxA AdjustWindowRect GetClientRect GetWindowTextW GetWindowTextA SetWindowTextW SetWindowTextA InvalidateRect EndPaint TranslateMessage

gdi32

GetTextMetricsA GetDIBits GetCurrentObject SelectClipRgn IntersectClipRect MoveToEx Rectangle LineTo CreateSolidBrush CreatePen CreateFontA GdiFlush SetBrushOrgEx SetWindowOrgEx SetWindowExtEx SetViewportOrgEx SetViewportExtEx LPtoDP TextOutA GetObjectA CreateDIBSection SetTextColor SetStretchBltMode StretchBlt SetMapMode SetDIBitsToDevice SetBkMode SelectObject SaveDC RestoreDC GetTextExtentPoint32A GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt

ws2_32

socket WSAStartup WSAGetLastError getaddrinfo freeaddrinfo connect send recv closesocket ioctlsocket setsockopt

winmm

mciSendStringA timeGetTime timeEndPeriod timeBeginPeriod

imm32

ImmGetVirtualKey ImmNotifyIME ImmSetOpenStatus ImmGetOpenStatus ImmSetConversionStatus ImmGetConversionStatus ImmAssociateContext ImmReleaseContext ImmGetContext ImmGetCompositionStringW

gdiplus

GdipFree GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipSaveImageToFile GdipCreateBitmapFromScan0 GdipGetImageEncodersSize GdipGetImageEncoders GdipAlloc

dsound

ord1

kernel32

UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType FlushFileBuffers GetFileSizeEx SetFilePointerEx SetStdHandle CreateDirectoryW RtlVirtualUnwind FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo RtlCaptureContext GetConsoleMode ReadFile CreatePipe DuplicateHandle GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue GetCommandLineW GetCommandLineA TerminateProcess GetConsoleOutputCP ExitProcess GetModuleFileNameW GetStdHandle IsProcessorFeaturePresent ReadConsoleW WriteFile FindFirstFileExW FlsAlloc SetLastError RtlLookupFunctionEntry RtlUnwindEx RaiseException RtlPcToFileHeader GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentVariableA GetCurrentDirectoryA FindClose FindFirstFileA FindNextFileA GetFileAttributesA QueryPerformanceCounter QueryPerformanceFrequency SetWaitableTimer Sleep GetCurrentProcess CreateThread GetCurrentThread SetThreadPriority CreateProcessA GetLocalTime GetTickCount GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryA MultiByteToWideChar WideCharToMultiByte IsDebuggerPresent CheckRemoteDebuggerPresent GetCurrentProcessId GetThreadContext GetWindowsDirectoryA CreateToolhelp32Snapshot Module32First Module32Next InitializeSListHead SetEnvironmentVariableW GetStringTypeW GetProcessHeap CreateFileW WriteConsoleW HeapSize HeapReAlloc SetEndOfFile CloseHandle GetLastError WaitForSingleObjectEx SwitchToThread GetCurrentThreadId GetExitCodeThread GetLogicalProcessorInformationEx ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable GetSystemTimeAsFileTime

advapi32

CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptDecrypt CryptReleaseContext CryptDeriveKey CryptAcquireContextA

Name

.text

Size

880KB

Virtual Size

879KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

153KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-30_f920300beb3e66e4b7b18b4e9da08fce_cobalt-strike_icedid_njrat_stealc

user32

gdi32

ws2_32

winmm

imm32

gdiplus

dsound

kernel32

advapi32

generic