2026-10-10_4ab6aafabef084ad051a0696e425acd2_cobalt-strike_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-10_4ab6aafabef084ad051a0696e425acd2_cobalt-strike_icedid_njrat
Size 786KB
Sample261011-sbm7msby8m
SHA256 2352236a78be1af2cb0347276a0cdc5750a57c649fb0ce989bf3598af679e0e4
MD5 4ab6aafabef084ad051a0696e425acd2
SHA1 e13c971c7b096d6fb90e8a64cbb81b39f2d02945
SHA512 0b09307d9c69ef75ea391096c15c77bde4a0b0edf7ece2e915880963e14840e00e31d725187d9686c08a20b920129752433cf08457f087476f09b4b35a690040
SSDEEP 6144:tDCcZXMHF98puvNMcPjwknnpC8aGbwwh8QyHZoSPlHJhWFuIrPA+VIM:RCc5Y8puVPjxnpC8aGbwwhDyfHJ6z
TLSH
T187059E652BE802D2E077D23DC9D59A96DAB2B8140730A7CB02D4429D3E23FE55E3F725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-10_4ab6aafabef084ad051a0696e425acd2_cobalt-strike_icedid_njrat

File Explorer

2026-10-10_4ab6aafabef084ad051a0696e425acd2_cobalt-strike_icedid_njrat

.exe 786KB

2026-10-10_4ab6aafabef084ad051a0696e425acd2_cobalt-strike_icedid_njrat

IMPHASH b38554315c29686e9bc805ad8bde6b34
SHA256 2352236a78be1af2cb0347276a0cdc5750a57c649fb0ce989bf3598af679e0e4
MD5 4ab6aafabef084ad051a0696e425acd2
SHA1 e13c971c7b096d6fb90e8a64cbb81b39f2d02945
SHA512 0b09307d9c69ef75ea391096c15c77bde4a0b0edf7ece2e915880963e14840e00e31d725187d9686c08a20b920129752433cf08457f087476f09b4b35a690040
SSDEEP 6144:tDCcZXMHF98puvNMcPjwknnpC8aGbwwh8QyHZoSPlHJhWFuIrPA+VIM:RCc5Y8puVPjxnpC8aGbwwhDyfHJ6z
TLSH
T187059E652BE802D2E077D23DC9D59A96DAB2B8140730A7CB02D4429D3E23FE55E3F725
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\everything-decomp\build\everything_ui_config_tests.pdb

user32

MessageBoxW

kernel32

FreeLibrary ReadConsoleW ExitProcess CompareStringOrdinal CreateFileW GetFileSizeEx ReadFile CloseHandle HeapAlloc HeapFree GetProcessHeap HeapReAlloc QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW WriteFile GetCurrentProcess TerminateProcess RtlUnwind GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter OutputDebugStringW SetConsoleCtrlHandler GetCurrentThread FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTempPathW IsThreadAFiber VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx HeapSize

Name

.text

Size

621KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

122KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-10_4ab6aafabef084ad051a0696e425acd2_cobalt-strike_icedid_njrat

user32

kernel32

generic