2026-10-11_583d19e93d44ab1afe839df269bf4369_cobalt-strike_icedid_njrat_stealc

General

Target
2026-10-11_583d19e93d44ab1afe839df269bf4369_cobalt-strike_icedid_njrat_stealc
Size 67.3MB
Sample261012-zy3n6sfs21
SHA256 d389ae5804584783f673bf0d3da0f9feacbbb633788ce123ec4012548b7b7a5c
MD5 583d19e93d44ab1afe839df269bf4369
SHA1 e41f70eba456bc7b6ba1ed82b8320e4cddb03653
SHA512 0d9666f5222a07f51bba03a4849a99b6d0511a25ae7296b944abbba8b4e5c0ec7986771446d158503d43ecb136fd932bfc76b2c5eaf7969c068474917e6b0826
SSDEEP 1572864:44naNZcspM2N6Hq5Jm1nHLUA6Y24HBtUP30evkAbCf:babdpfb52HfXZfbPAWf
TLSH
T1D8F7331BA6F440F8C09BD379CA06191EFA72740117749EDB66908AA13F33DF1AB7A354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-11_583d19e93d44ab1afe839df269bf4369_cobalt-strike_icedid_njrat_stealc

File Explorer

2026-10-11_583d19e93d44ab1afe839df269bf4369_cobalt-strike_icedid_njrat_stealc

.exe 67.3MB

2026-10-11_583d19e93d44ab1afe839df269bf4369_cobalt-strike_icedid_njrat_stealc

IMPHASH 184ca7e8816051f634bb6d6586511329
SHA256 d389ae5804584783f673bf0d3da0f9feacbbb633788ce123ec4012548b7b7a5c
MD5 583d19e93d44ab1afe839df269bf4369
SHA1 e41f70eba456bc7b6ba1ed82b8320e4cddb03653
SHA512 0d9666f5222a07f51bba03a4849a99b6d0511a25ae7296b944abbba8b4e5c0ec7986771446d158503d43ecb136fd932bfc76b2c5eaf7969c068474917e6b0826
SSDEEP 1572864:44naNZcspM2N6Hq5Jm1nHLUA6Y24HBtUP30evkAbCf:babdpfb52HfXZfbPAWf
TLSH
T1D8F7331BA6F440F8C09BD379CA06191EFA72740117749EDB66908AA13F33DF1AB7A354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1079984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ecomiller\source\repos\BlueStacksSetup\x64\Release\ZeninCrack.pdb

kernel32

WriteFile TerminateProcess CreateMutexW CreateFileW GetFileAttributesW ReleaseMutex OpenProcess CreateToolhelp32Snapshot Sleep GetTempPathA GetLastError Process32NextW LockResource DeleteFileA DeleteFileW Process32FirstW CloseHandle LoadResource FindResourceW GetLocalTime GetProcAddress CreateProcessW GetModuleHandleW WideCharToMultiByte GetTickCount GetDriveTypeW GetComputerNameA MultiByteToWideChar AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetLogicalDrives SetEndOfFile UnlockFileEx GetTempPathW WaitForSingleObject GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx HeapReAlloc RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter FlushFileBuffers WriteConsoleW GetFullPathNameA SizeofResource SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetStdHandle ReadConsoleW EnumSystemLocalesW GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive GetExitCodeThread InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime IsProcessorFeaturePresent GetStdHandle GetModuleFileNameW GetCurrentProcess ExitProcess RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetFileSizeEx SetFilePointerEx GetConsoleOutputCP GetConsoleMode VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID RtlUnwind

advapi32

GetUserNameA

shell32

ShellExecuteW SHGetFolderPathA

winhttp

WinHttpSetOption WinHttpQueryHeaders WinHttpSendRequest WinHttpConnect WinHttpOpenRequest WinHttpReceiveResponse WinHttpReadData WinHttpOpen WinHttpCloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-11_583d19e93d44ab1afe839df269bf4369_cobalt-strike_icedid_njrat_stealc

kernel32

advapi32

shell32

winhttp

generic