2026-10-18_8c71ad3ff656c44000144ff2782df2bb_cobalt-strike_icedid_njrat

General

Target
2026-10-18_8c71ad3ff656c44000144ff2782df2bb_cobalt-strike_icedid_njrat
Size 621KB
Sample261018-nrlljayvby
SHA256 c72ccfce72161d32dae64d5ce5b3fe722a4529fd5ce7adb589dfbdd4389bf089
MD5 8c71ad3ff656c44000144ff2782df2bb
SHA1 865329b23cda041d38a54122cbe503eb6e74f07f
SHA512 a60a3aaeb82250a575cbecedef427fa9dbb284cbcaf762a1158706ea04603663cb9025e7945270ae29855909cc062bdd336cf31d3f30a04c1a28df4484187f88
SSDEEP 12288:nsuaKe0QgW33B6v/Pb50Y2rf1FoWnC9WCYsmBGiSLL:sx7RmgTCDmk/
TLSH
T12AD4EFD75BD5E2FCE02392B28052C2CBA7F2687103B1579E87718F312E576965F28B12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-18_8c71ad3ff656c44000144ff2782df2bb_cobalt-strike_icedid_njrat

File Explorer

2026-10-18_8c71ad3ff656c44000144ff2782df2bb_cobalt-strike_icedid_njrat

.exe 621KB

2026-10-18_8c71ad3ff656c44000144ff2782df2bb_cobalt-strike_icedid_njrat

IMPHASH cadb0e71c576b71841c41aa829f8cf3d
SHA256 c72ccfce72161d32dae64d5ce5b3fe722a4529fd5ce7adb589dfbdd4389bf089
MD5 8c71ad3ff656c44000144ff2782df2bb
SHA1 865329b23cda041d38a54122cbe503eb6e74f07f
SHA512 a60a3aaeb82250a575cbecedef427fa9dbb284cbcaf762a1158706ea04603663cb9025e7945270ae29855909cc062bdd336cf31d3f30a04c1a28df4484187f88
SSDEEP 12288:nsuaKe0QgW33B6v/Pb50Y2rf1FoWnC9WCYsmBGiSLL:sx7RmgTCDmk/
TLSH
T12AD4EFD75BD5E2FCE02392B28052C2CBA7F2687103B1579E87718F312E576965F28B12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetEnvironmentVariableA GetTempPathA GetCurrentProcessId GetSystemInfo GetSystemTime lstrlenA WriteConsoleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle

Name

.text

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

513KB

Virtual Size

513KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-18_8c71ad3ff656c44000144ff2782df2bb_cobalt-strike_icedid_njrat

kernel32

generic