2026-10-22_6c62893b3f0fc8f750642a869b585d29_cobalt-strike_icedid_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_6c62893b3f0fc8f750642a869b585d29_cobalt-strike_icedid_njrat
Size 648KB
Sample261024-lmg2fatvav
SHA256 6ee1a99f57225fa03060cde56233e47f98b70d959a9c74891b4a537d3f270a8e
MD5 6c62893b3f0fc8f750642a869b585d29
SHA1 81ae869dd2698d1ae8101c26d1230d320b945d45
SHA512 d833241195f76c085d2b7a228f6530a6a37fd1eb78466d7b58a8c28bfc420c5c0f62d6cda86b8534974e3791c7704461df4418043b652facabec002f434eba79
SSDEEP 6144:qbsy4Ukz9ZOj3BXTPzmVisugPKF/AxJ8ZwefNIc74OvyuD8wlOVi+/:qbstH9gj3VfLsusKto8ZwENn61ws/
TLSH
T1E7E49F6177E812D6E0B7D13E8AD58F6AF6B2B816073097C701D442992F1BAE45E3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_6c62893b3f0fc8f750642a869b585d29_cobalt-strike_icedid_njrat

File Explorer

2026-10-22_6c62893b3f0fc8f750642a869b585d29_cobalt-strike_icedid_njrat

.exe 648KB

2026-10-22_6c62893b3f0fc8f750642a869b585d29_cobalt-strike_icedid_njrat

IMPHASH d0a66855bb8dbc6b7b8d98694648d94a
SHA256 6ee1a99f57225fa03060cde56233e47f98b70d959a9c74891b4a537d3f270a8e
MD5 6c62893b3f0fc8f750642a869b585d29
SHA1 81ae869dd2698d1ae8101c26d1230d320b945d45
SHA512 d833241195f76c085d2b7a228f6530a6a37fd1eb78466d7b58a8c28bfc420c5c0f62d6cda86b8534974e3791c7704461df4418043b652facabec002f434eba79
SSDEEP 6144:qbsy4Ukz9ZOj3BXTPzmVisugPKF/AxJ8ZwefNIc74OvyuD8wlOVi+/:qbstH9gj3VfLsusKto8ZwENn61ws/
TLSH
T1E7E49F6177E812D6E0B7D13E8AD58F6AF6B2B816073097C701D442992F1BAE45E3F321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7146

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\bberraies\Desktop\code\handmade\main.pdb

kernel32

QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW WriteConsoleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent GetCurrentThread RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter OutputDebugStringW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTempPathW IsThreadAFiber VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetProcessHeap SetConsoleCtrlHandler HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadFile ReadConsoleW CreateFileW CloseHandle RtlUnwind

Name

.text

Size

521KB

Virtual Size

521KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_6c62893b3f0fc8f750642a869b585d29_cobalt-strike_icedid_njrat

kernel32

generic