2026-10-18_469437ced2f1d09b8ef5c2dfdf612cf1_cobalt-strike_icedid_njrat_stealc

General

Target
2026-10-18_469437ced2f1d09b8ef5c2dfdf612cf1_cobalt-strike_icedid_njrat_stealc
Size 446KB
Sample261018-skgffsbe39
SHA256 f359fff2ec011e3f6f2befe3454551e3c84a387c2885365c3e02395450afe54e
MD5 469437ced2f1d09b8ef5c2dfdf612cf1
SHA1 ee810efbc327a4ac1d07629340793d29eff72a00
SHA512 9a5c4792eedff11b5258e3ed4e1cf3306aaf1f892f810afa70725339844798fc698fd17bc7ad1c458567817ad47fadbb817f3a2031aac26c1a15e7b0d12f1220
SSDEEP 6144:HncApu16StM+ybRW7jMF1KobpStqC9OjRWQejjxpiCWcZIUOMbt6:8c+y+aCdO1WQeJpiqZIf
TLSH
T1D6A46C35B6EE00F9E163C43888174E17D67678054B60EADF03E886761E7BAD06E3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-18_469437ced2f1d09b8ef5c2dfdf612cf1_cobalt-strike_icedid_njrat_stealc

File Explorer

2026-10-18_469437ced2f1d09b8ef5c2dfdf612cf1_cobalt-strike_icedid_njrat_stealc

.exe 446KB

2026-10-18_469437ced2f1d09b8ef5c2dfdf612cf1_cobalt-strike_icedid_njrat_stealc

IMPHASH 07aabaa3c9433870fc5b86196fba6544
SHA256 f359fff2ec011e3f6f2befe3454551e3c84a387c2885365c3e02395450afe54e
MD5 469437ced2f1d09b8ef5c2dfdf612cf1
SHA1 ee810efbc327a4ac1d07629340793d29eff72a00
SHA512 9a5c4792eedff11b5258e3ed4e1cf3306aaf1f892f810afa70725339844798fc698fd17bc7ad1c458567817ad47fadbb817f3a2031aac26c1a15e7b0d12f1220
SSDEEP 6144:HncApu16StM+ybRW7jMF1KobpStqC9OjRWQejjxpiCWcZIUOMbt6:8c+y+aCdO1WQeJpiqZIf
TLSH
T1D6A46C35B6EE00F9E163C43888174E17D67678054B60EADF03E886761E7BAD06E3DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

161816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Admin\source\repos\Nexomia-Injector-V2\x64\Release\Injector.pdb

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

kernel32

GetOEMCP GetACP SetEndOfFile SetCurrentDirectoryW CreateFileW GetFileAttributesW GetFileSize GetFileSizeEx ReadFile WriteFile GetTempPathW CloseHandle DuplicateHandle GetLastError Sleep GetCurrentProcess GetCurrentProcessId GetExitCodeProcess GetProcessId OpenProcess VirtualAlloc VirtualFree VirtualAllocEx VirtualProtectEx VirtualQueryEx ReadProcessMemory WriteProcessMemory VirtualFreeEx IsWow64Process GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryW QueryFullProcessImageNameW SetConsoleTitleW CreateToolhelp32Snapshot Process32First Process32Next Module32FirstW Module32NextW Module32First Module32Next K32GetMappedFileNameW OpenThread SuspendThread ResumeThread Thread32First Thread32Next IsValidCodePage HeapReAlloc ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW RaiseException QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId GetNativeSystemInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW LocalFree FormatMessageA GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW SetFileInformationByHandle AreFileApisANSI EnumSystemLocalesW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent WaitForThreadpoolWorkCallbacks EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW InitializeSListHead TerminateProcess SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetStdHandle GetCommandLineA GetCommandLineW HeapFree WaitForSingleObject CreateProcessW HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID GetEnvironmentStringsW

user32

GetWindow GetWindowThreadProcessId EnumWindows FindWindowW GetWindowLongPtrW GetWindowTextW IsWindowVisible

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlUnwind RtlPcToFileHeader RtlUnwindEx RtlCaptureContext

Name

.text

Size

314KB

Virtual Size

314KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-18_469437ced2f1d09b8ef5c2dfdf612cf1_cobalt-strike_icedid_njrat_stealc

version

kernel32

user32

ntdll

generic