2026-10-22_bf5a3ab292aecace263b5b290ad6e2d2_cobalt-strike_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_bf5a3ab292aecace263b5b290ad6e2d2_cobalt-strike_icedid_njrat
Size 547KB
Sample261023-129gkaes21
SHA256 83b4be95ac6bcee763b60a0c51fbc75ba10e81034e1e8c80c02bb277a06616a3
MD5 bf5a3ab292aecace263b5b290ad6e2d2
SHA1 47d03fb8d3e3350685bdf663579f0c46f840dd76
SHA512 02249f026caa8e6055f8c89309078c14dcb3ecdf2733b9b7787b93519617a8d42712a2c38d66ecf6c6e43199ea537108bd900e3085289e76ef623e6374cafccd
SSDEEP 12288:x6TYOiUXqbLN8lj5QDzV+FNUL+p5a1IzYYw:xSYOvXqOjCd+FNU6pA1
TLSH
T161C47D26E54411BCD076D2F89EA77912E7727846033159EF03D06AD33E2AAE49F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_bf5a3ab292aecace263b5b290ad6e2d2_cobalt-strike_icedid_njrat

File Explorer

2026-10-22_bf5a3ab292aecace263b5b290ad6e2d2_cobalt-strike_icedid_njrat

.exe 547KB

2026-10-22_bf5a3ab292aecace263b5b290ad6e2d2_cobalt-strike_icedid_njrat

IMPHASH a518916fbd1d535d32034badb419007b
SHA256 83b4be95ac6bcee763b60a0c51fbc75ba10e81034e1e8c80c02bb277a06616a3
MD5 bf5a3ab292aecace263b5b290ad6e2d2
SHA1 47d03fb8d3e3350685bdf663579f0c46f840dd76
SHA512 02249f026caa8e6055f8c89309078c14dcb3ecdf2733b9b7787b93519617a8d42712a2c38d66ecf6c6e43199ea537108bd900e3085289e76ef623e6374cafccd
SSDEEP 12288:x6TYOiUXqbLN8lj5QDzV+FNUL+p5a1IzYYw:xSYOvXqOjCd+FNU6pA1
TLSH
T161C47D26E54411BCD076D2F89EA77912E7727846033159EF03D06AD33E2AAE49F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

293216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpCrackUrl

iphlpapi

IcmpCreateFile GetAdaptersAddresses IcmpCloseHandle IcmpSendEcho GetExtendedTcpTable

ws2_32

getaddrinfo freeaddrinfo WSAAddressToStringA WSACleanup ntohs WSAStartup

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree

gdi32

DeleteDC BitBlt SetDeviceGammaRamp DeleteObject SelectObject CreateDIBSection CreateCompatibleDC

advapi32

RegDeleteValueW AllocateAndInitializeSid CheckTokenMembership RegSetValueExW RegSetValueExA RegQueryValueExA RegOpenKeyExW RegOpenKeyExA RegEnumValueA RegEnumKeyExA OpenProcessToken RegCreateKeyExW RegCreateKeyExA RegCloseKey GetUserNameA GetTokenInformation FreeSid

shell32

SHGetFolderPathW ShellExecuteW

user32

CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW GetKeyboardState GetKeyState PostThreadMessageW GetMessageW GetKeyboardLayout ToUnicodeEx EnumDisplayMonitors SystemParametersInfoW LockWorkStation BlockInput EnumDisplaySettingsW ChangeDisplaySettingsW SetCursorPos MessageBoxW ReleaseDC GetDC SendInput mouse_event VkKeyScanA EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SendMessageW ExitWindowsEx

winmm

mciSendStringW

crypt32

CryptUnprotectData

mf

MFEnumDeviceSources

mfplat

MFStartup MFCreateMediaType MFCreateAttributes MFShutdown

mfreadwrite

MFCreateSourceReaderFromMediaSource

kernel32

SetFilePointerEx FindFirstFileExW GetCommandLineW GetEnvironmentStringsW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW ReadConsoleW HeapSize HeapReAlloc SetEndOfFile LCMapStringW CompareStringW LoadLibraryExW VirtualProtect GetFileType HeapAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread FreeLibrary ExitThread CreateThread DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue WriteConsoleW SetHandleInformation FlsGetValue FlsAlloc SetLastError RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader GetTempPathW Sleep GetLocalTime GetLastError MultiByteToWideChar GetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExA GetFileAttributesW GetFileSizeEx ReadFile RemoveDirectoryW SetFileAttributesW WriteFile CloseHandle CreatePipe PeekNamedPipe WaitForSingleObject GetProcessTimes GetCurrentProcess ExitProcess TerminateProcess CreateProcessW OpenProcess GlobalMemoryStatusEx GetSystemInfo GetTickCount GetTickCount64 GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryW GlobalAlloc GlobalUnlock GlobalLock GetLogicalDriveStringsA CopyFileW GetComputerNameA GetSystemPowerStatus WideCharToMultiByte CreateToolhelp32Snapshot Process32First Process32Next K32GetProcessMemoryInfo GetCurrentThreadId LocalFree ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsProcessorFeaturePresent

Name

.text

Size

418KB

Virtual Size

418KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_bf5a3ab292aecace263b5b290ad6e2d2_cobalt-strike_icedid_njrat

winhttp

iphlpapi

ws2_32

ole32

gdi32

advapi32

shell32

user32

winmm

crypt32

mf

mfplat

mfreadwrite

kernel32

generic