2026-10-01_88ef76e758d8ef820830893bbc75f922_cobalt-strike_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_88ef76e758d8ef820830893bbc75f922_cobalt-strike_icedid_njrat_stealc
Size 3.6MB
Sample261002-lmydesxtbs
SHA256 8793c11bc1531cbb29bfba038c3b8c1724e6a973843f5a15b1f5b845e88a0a0f
MD5 88ef76e758d8ef820830893bbc75f922
SHA1 51b62aaa2c649fb653e2855d514cfc63b244ad39
SHA512 981c088382f3df31ca0fed6a168a4df8c5a86effd4fb288c69e1ea03052ba814ac7495b83d4a2b57250acd63350fc8f249836999a41f0a877adda1e8a14b2674
SSDEEP 98304:4W9hW+5D44GWQs/RJaZ75UDhnZFURRAJ3z3CI:ZzW+5DJ0GJauhZFUQJ3z3
TLSH
T17C06011581C412F5C07BD37881CB4A0FF3A1714A93A64EDF26D198424B93FD3AA7A76E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
sample	INDICATOR_EXE_Packed_VMProtect

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_88ef76e758d8ef820830893bbc75f922_cobalt-strike_icedid_njrat_stealc

File Explorer

2026-10-01_88ef76e758d8ef820830893bbc75f922_cobalt-strike_icedid_njrat_stealc

.exe 3.6MB

2026-10-01_88ef76e758d8ef820830893bbc75f922_cobalt-strike_icedid_njrat_stealc

IMPHASH 62e83cf7b90e82e207b751a08bfad7f0
SHA256 8793c11bc1531cbb29bfba038c3b8c1724e6a973843f5a15b1f5b845e88a0a0f
MD5 88ef76e758d8ef820830893bbc75f922
SHA1 51b62aaa2c649fb653e2855d514cfc63b244ad39
SHA512 981c088382f3df31ca0fed6a168a4df8c5a86effd4fb288c69e1ea03052ba814ac7495b83d4a2b57250acd63350fc8f249836999a41f0a877adda1e8a14b2674
SSDEEP 98304:4W9hW+5D44GWQs/RJaZ75UDhnZFURRAJ3z3CI:ZzW+5DJ0GJauhZFUQJ3z3
TLSH
T17C06011581C412F5C07BD37881CB4A0FF3A1714A93A64EDF26D198424B93FD3AA7A76E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables packed with VMProtect.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

235760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_BIND IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

DeleteFileW FlushFileBuffers GetTempPathW GetFirmwareEnvironmentVariableW SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID GetModuleHandleA GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect GetFileType HeapFree GetCurrentThreadId GetFileAttributesW VirtualAlloc DeviceIoControl WriteFile VirtualFree GetFileSizeEx IsDebuggerPresent OpenThread lstrcmpiA GetThreadContext CreateThread Process32Next GetEnvironmentVariableA Thread32First Thread32Next Process32First GlobalUnlock GlobalLock GlobalFree GlobalAlloc GetLastError CreateFileW GetVolumeInformationA GetTickCount GetLocalTime GetCurrentProcessId K32GetModuleBaseNameA Process32FirstW Process32NextW MultiByteToWideChar CreateToolhelp32Snapshot OpenProcess K32EnumProcessModulesEx WriteProcessMemory TerminateProcess K32GetDeviceDriverFileNameA GetCurrentProcess K32EnumDeviceDrivers GetExitCodeProcess VirtualFreeEx GetModuleHandleW ReadProcessMemory VirtualAllocEx GetProcAddress VirtualProtectEx CloseHandle LoadLibraryA UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext HeapAlloc GetStdHandle GetModuleFileNameW ExitProcess IsProcessorFeaturePresent GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError Sleep RtlAddFunctionTable IsValidLocale ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException RtlUnwind

user32

MessageBoxW EndPaint BeginPaint ReleaseDC InvalidateRect SetProcessDPIAware UpdateWindow PostQuitMessage KillTimer DrawTextW GetClientRect SetCursor SetCapture ExitWindowsEx ReleaseCapture LoadCursorW OpenClipboard CloseClipboard EmptyClipboard SetClipboardData GetMessageW DefWindowProcW PostMessageW DestroyWindow GetDC SetWindowRgn FillRect CreateWindowExW ScreenToClient GetSystemMetrics RegisterClassExW ShowWindow GetCapture DispatchMessageW SetTimer TranslateMessage LoadIconW

gdi32

DeleteObject Ellipse MoveToEx BitBlt SelectObject CreateDIBSection CreateCompatibleDC CreateFontW GetStockObject CreateRoundRectRgn DeleteDC GetTextExtentPoint32W SetTextColor SetBkMode LineTo CreatePen Rectangle Polygon CreateSolidBrush

advapi32

RegQueryValueExA QueryServiceStatusEx OpenServiceW QueryServiceConfigW RegSetKeyValueW RegCreateKeyExW RegEnumKeyExW RegDeleteTreeW RegSetValueExW RegOpenKeyExW RegGetValueW RegCreateKeyW RegDeleteValueW RegOpenKeyW RegQueryValueExW RegCloseKey RegOpenKeyExA LookupPrivilegeValueW AdjustTokenPrivileges CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid ControlService OpenProcessToken FreeSid StartServiceW EnumServicesStatusExW CheckTokenMembership

shell32

ShellExecuteW

winhttp

WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpSetTimeouts

iphlpapi

GetAdaptersAddresses GetAdaptersInfo

Name

.text

Size

385KB

Virtual Size

384KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

524KB

Virtual Size

524KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.vmp0

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_88ef76e758d8ef820830893bbc75f922_cobalt-strike_icedid_njrat_stealc

kernel32

user32

gdi32

advapi32

shell32

winhttp

iphlpapi

generic