2026-10-16_b82d050fc81d41a3807b41aa7c3355f5_cobalt-strike_icedid_njrat_stealc

General

Target
2026-10-16_b82d050fc81d41a3807b41aa7c3355f5_cobalt-strike_icedid_njrat_stealc
Size 383KB
Sample261017-kdnbesea37
SHA256 fe0c1eec92d2696ef1327547e0a03f9113cf2afa5e867dde1981552a415b43c8
MD5 b82d050fc81d41a3807b41aa7c3355f5
SHA1 99c9133b6c23557a07ffa14833158aef2d81a2aa
SHA512 01f88143f143258e62d1caf85ca1253bc3b94e2ca300a034c802567460bfbd843204f89df05fc47244b726528b5e1cdf5b460c8bacfbd2e0397312172f9dc21e
SSDEEP 6144:XaSjMzluATBzACOxf28x9FPCIAsNiqMvrvtFqHZbG8j:MZTNAThTxCIAoMvbtFabG
TLSH
T1DC847E2AE7A414F8E167D174CE524D06E7B27C4A0771E6CF23A40AA61F276E05E3DF12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_b82d050fc81d41a3807b41aa7c3355f5_cobalt-strike_icedid_njrat_stealc

File Explorer

2026-10-16_b82d050fc81d41a3807b41aa7c3355f5_cobalt-strike_icedid_njrat_stealc

.exe 383KB

2026-10-16_b82d050fc81d41a3807b41aa7c3355f5_cobalt-strike_icedid_njrat_stealc

IMPHASH 0b8fc73e40844ef28d289c4dbac5f27d
SHA256 fe0c1eec92d2696ef1327547e0a03f9113cf2afa5e867dde1981552a415b43c8
MD5 b82d050fc81d41a3807b41aa7c3355f5
SHA1 99c9133b6c23557a07ffa14833158aef2d81a2aa
SHA512 01f88143f143258e62d1caf85ca1253bc3b94e2ca300a034c802567460bfbd843204f89df05fc47244b726528b5e1cdf5b460c8bacfbd2e0397312172f9dc21e
SSDEEP 6144:XaSjMzluATBzACOxf28x9FPCIAsNiqMvrvtFqHZbG8j:MZTNAThTxCIAoMvbtFabG
TLSH
T1DC847E2AE7A414F8E167D174CE524D06E7B27C4A0771E6CF23A40AA61F276E05E3DF12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

142076

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetEnvironmentVariableW CreateFileW GetFullPathNameW CloseHandle GetLastError DeviceIoControl WaitForSingleObject Sleep CreateRemoteThread GetExitCodeThread OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleHandleW GetProcAddress CreateToolhelp32Snapshot Process32FirstW Process32NextW WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead WriteConsoleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ReadFile ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize SetEndOfFile RtlUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-16_b82d050fc81d41a3807b41aa7c3355f5_cobalt-strike_icedid_njrat_stealc

kernel32

generic