2026-10-02_378240ca815d9200a8a5abd447e980ab_cobalt-strike_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-02_378240ca815d9200a8a5abd447e980ab_cobalt-strike_icedid_njrat_stealc
Size 1.2MB
Sample261003-rw2p4adf99
SHA256 e9e63ae4f5bc696d2726783a35458b304604c60578f362355a17f5de2e8e0173
MD5 378240ca815d9200a8a5abd447e980ab
SHA1 4079a287f47d45c259d7d32baaf554abb208a059
SHA512 b983d2b5f3f33b487e5643b1d63da9546cb2b3f8e70d4e43c70b9efe2f976d08b57224a7b343b064a5974c635199ab3730336b145a64f800e8dc5f27aedd111b
SSDEEP 24576:uAUE9zf5d+oIaijfSB1pTUbp3x+4ijsIuSElKsZuCnOk:D19xdyH6Ubp3mjlMlfnH
TLSH
T155559E42E2A841E8C1ABD1788656961FE77178050320ABDB27EC5F663F63BE15F7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-02_378240ca815d9200a8a5abd447e980ab_cobalt-strike_icedid_njrat_stealc

File Explorer

2026-10-02_378240ca815d9200a8a5abd447e980ab_cobalt-strike_icedid_njrat_stealc

.exe 1.2MB

2026-10-02_378240ca815d9200a8a5abd447e980ab_cobalt-strike_icedid_njrat_stealc

IMPHASH bb455b80bfac1c77f4a5152e4eada0b4
SHA256 e9e63ae4f5bc696d2726783a35458b304604c60578f362355a17f5de2e8e0173
MD5 378240ca815d9200a8a5abd447e980ab
SHA1 4079a287f47d45c259d7d32baaf554abb208a059
SHA512 b983d2b5f3f33b487e5643b1d63da9546cb2b3f8e70d4e43c70b9efe2f976d08b57224a7b343b064a5974c635199ab3730336b145a64f800e8dc5f27aedd111b
SSDEEP 24576:uAUE9zf5d+oIaijfSB1pTUbp3x+4ijsIuSElKsZuCnOk:D19xdyH6Ubp3mjlMlfnH
TLSH
T155559E42E2A841E8C1ABD1788656961FE77178050320ABDB27EC5F663F63BE15F7E310
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

329552

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\unret\OneDrive\Desktop\melancholy_hacks\loader\x64\Release\loader.pdb

kernel32

TerminateProcess InitializeCriticalSectionEx WaitForSingleObject OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Sleep GetTempPathA GetLastError Process32NextW CreateFileA DeleteFileA Process32FirstW CloseHandle Module32FirstW GetLocalTime DecodePointer VirtualAllocEx DeleteCriticalSection GetModuleHandleW CreateRemoteThread Module32NextW VirtualFreeEx GetSystemFirmwareTable GetComputerNameA EnterCriticalSection LeaveCriticalSection InitializeCriticalSection GetSystemInfo WriteConsoleW CreateFileW HeapSize SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx WriteFile GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleFileNameW IsProcessorFeaturePresent ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind FlsFree FlsSetValue GetCurrentProcess WriteProcessMemory GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary GetProcAddress FlsGetValue FlsAlloc SetLastError RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry RaiseException OutputDebugStringW IsDebuggerPresent CreateFileMappingA UnmapViewOfFile MapViewOfFile GetProcessHeap HeapFree HeapReAlloc HeapAlloc ReadFile GetFileSizeEx QueryPerformanceFrequency LoadLibraryA InitializeSListHead GetSystemTimeAsFileTime SetEndOfFile GetCurrentProcessId MultiByteToWideChar GetLocaleInfoA EnumSystemLocalesW GetModuleFileNameA GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI GetFileInformationByHandleEx WakeAllConditionVariable EncodePointer LCMapStringEx GetStringTypeW GetCPInfo SetUnhandledExceptionFilter GetStartupInfoW

user32

ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetMessageExtraInfo SetCursorPos GetCursorPos GetForegroundWindow GetKeyState DefWindowProcW GetWindowRect DestroyWindow CreateWindowExW GetSystemMetrics RegisterClassExW ShowWindow DispatchMessageW PeekMessageW MoveWindow TranslateMessage LoadIconW PostQuitMessage UpdateWindow GetWindowThreadProcessId UnregisterClassW GetClassNameA GetWindowTextA EnumWindows OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData

advapi32

RegCloseKey OpenProcessToken LookupPrivilegeValueA RegQueryValueExW AdjustTokenPrivileges RegOpenKeyExW

shell32

ShellExecuteExW ShellExecuteW

vmprotectsdk64

VMProtectBeginVirtualization VMProtectBeginUltra VMProtectBeginMutation VMProtectEnd

wininet

InternetCheckConnectionA HttpQueryInfoA HttpOpenRequestA InternetSetOptionA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA InternetReadFile

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

926KB

Virtual Size

925KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

279KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-02_378240ca815d9200a8a5abd447e980ab_cobalt-strike_icedid_njrat_stealc

kernel32

user32

advapi32

shell32

vmprotectsdk64

wininet

d3d11

d3dcompiler_47

imm32

generic