2026-10-22_4a60a84368470cf07d9ab1d207f6e624_cobalt-strike_icedid_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_4a60a84368470cf07d9ab1d207f6e624_cobalt-strike_icedid_njrat_ryuk
Size 923KB
Sample261024-rfpqlazt9p
SHA256 870d8d9dd03c3479861d148697588320a83173452ac03719e1d0f5b4d58526cf
MD5 4a60a84368470cf07d9ab1d207f6e624
SHA1 0cb2592c9d6189c2991b2cc009d70ed377123202
SHA512 a3fa1c10f9fb8ff7ebf1617c3e05f89c0b9928fab17672b14baa19a1a77f0d1b888167b0f6c96b9d2c25e29e9eec801e298f53c1d5c2a9e2c463800dedcdbaba
SSDEEP 12288:LuLZwgIWGvVYew8s5gh1Unh+9H98bwkiXhLPZhJyHB7kzBlRIh:6S7Unh+9HMwvPZhJrzNk
TLSH
T19015844BFBB611E5F5BAC1399962322AFC7234A147389BD757815A0A0B30FE4AD3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_4a60a84368470cf07d9ab1d207f6e624_cobalt-strike_icedid_njrat_ryuk

File Explorer

2026-10-22_4a60a84368470cf07d9ab1d207f6e624_cobalt-strike_icedid_njrat_ryuk

.exe 923KB

2026-10-22_4a60a84368470cf07d9ab1d207f6e624_cobalt-strike_icedid_njrat_ryuk

IMPHASH 2c6c43d83f242981ec49b87dd0261828
SHA256 870d8d9dd03c3479861d148697588320a83173452ac03719e1d0f5b4d58526cf
MD5 4a60a84368470cf07d9ab1d207f6e624
SHA1 0cb2592c9d6189c2991b2cc009d70ed377123202
SHA512 a3fa1c10f9fb8ff7ebf1617c3e05f89c0b9928fab17672b14baa19a1a77f0d1b888167b0f6c96b9d2c25e29e9eec801e298f53c1d5c2a9e2c463800dedcdbaba
SSDEEP 12288:LuLZwgIWGvVYew8s5gh1Unh+9H98bwkiXhLPZhJyHB7kzBlRIh:6S7Unh+9HMwvPZhJrzNk
TLSH
T19015844BFBB611E5F5BAC1399962322AFC7234A147389BD757815A0A0B30FE4AD3D311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\01.Project\01.Tmk\01.Paint\02Line\01.Shashuken\01.MainController\CLang\build\clang-debug\Libraries\ObjectIF\test_notice_task.pdb

kernel32

CloseHandle CompareStringW CreateFileW CreateThread DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetTimeFormatW GetUserDefaultLCID HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize HeapValidate InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableCS TerminateProcess UnhandledExceptionFilter VirtualProtect WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

713KB

Virtual Size

712KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_guard_c

Size

512B

Virtual Size

36B

Characteristics

Name

_guard_d

Size

512B

Virtual Size

36B

Characteristics

Name

memcmp_

Size

512B

Virtual Size

88B

Characteristics

Name

memcpy_

Size

512B

Virtual Size

332B

Characteristics

Name

memset_

Size

512B

Virtual Size

120B

Characteristics

Name

.rsrc

Size

512B

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_4a60a84368470cf07d9ab1d207f6e624_cobalt-strike_icedid_njrat_ryuk

kernel32

generic