2026-10-22_43bdcea332dba1920df372f1bbc307f8_cobalt-strike_icedid_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_43bdcea332dba1920df372f1bbc307f8_cobalt-strike_icedid_njrat_stealc
Size 904KB
Sample261024-sefa7sct5n
SHA256 fe3c01f1d987c8fa8866e58aba695430402284fe1152e7a608e67df1eeb5633c
MD5 43bdcea332dba1920df372f1bbc307f8
SHA1 90cc05ca3ee245977d680308f73ceb4623748e55
SHA512 2d443829ad7690475e348fe19ae2d86e84506883a61684b305c64400863b77bfccab3758498506680ea2fd8fd8d4b5a4575b84382cbe62fc2d7b29c563d18e97
SSDEEP 12288:P8CKhrggNk5a22dtw8SS1n3EVpnO1Ip6oGb+wbz2A4UA1s+r7MRnLoGXT:P8lq2DwHun3gO1r0Ucs+sRnL9j
TLSH
T170159D49A2A481F9F463907C8866E107F5713849C750CADF67E44A563FB72E06ABF332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_43bdcea332dba1920df372f1bbc307f8_cobalt-strike_icedid_njrat_stealc

File Explorer

2026-10-22_43bdcea332dba1920df372f1bbc307f8_cobalt-strike_icedid_njrat_stealc

.exe 904KB

2026-10-22_43bdcea332dba1920df372f1bbc307f8_cobalt-strike_icedid_njrat_stealc

IMPHASH b3f777e61597a0754aa45b2f5c4fab5c
SHA256 fe3c01f1d987c8fa8866e58aba695430402284fe1152e7a608e67df1eeb5633c
MD5 43bdcea332dba1920df372f1bbc307f8
SHA1 90cc05ca3ee245977d680308f73ceb4623748e55
SHA512 2d443829ad7690475e348fe19ae2d86e84506883a61684b305c64400863b77bfccab3758498506680ea2fd8fd8d4b5a4575b84382cbe62fc2d7b29c563d18e97
SSDEEP 12288:P8CKhrggNk5a22dtw8SS1n3EVpnO1Ip6oGb+wbz2A4UA1s+r7MRnLoGXT:P8lq2DwHun3gO1r0Ucs+sRnL9j
TLSH
T170159D49A2A481F9F463907C8866E107F5713849C750CADF67E44A563FB72E06ABF332
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

336712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\bjon2\OneDrive\Desktop\freefn\x64\Release\bestfreecheeto.pdb

d3d9

Direct3DCreate9Ex

kernel32

OpenProcess CreateToolhelp32Snapshot CreateEventW MultiByteToWideChar Sleep GetTempPathA GetTickCount64 GetLastError Process32NextW CreateFileA SetEvent LoadLibraryA QueryPerformanceFrequency DeleteFileA Process32FirstW CloseHandle GetProcAddress ExitProcess GetCurrentProcessId GetModuleHandleW WideCharToMultiByte GetConsoleWindow QueryFullProcessImageNameW CreateProcessA SetConsoleOutputCP lstrcmpiW QueryPerformanceCounter GetExitCodeProcess GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA FreeLibrary WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP GetModuleHandleA FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetFileSizeEx SetFilePointerEx GetFileAttributesExW CreateProcessW ReadConsoleW ReadConsoleInputW SetConsoleMode GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetCommandLineA GetStdHandle GetModuleFileNameW GetConsoleCP ReleaseMutex GetCurrentThreadId CreateFileW WaitForSingleObject CreateMutexW CreatePipe TerminateProcess DeviceIoControl WriteFile GetCurrentProcess SetConsoleTitleA GetCommandLineW SetHandleInformation SetConsoleCtrlHandler GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread RtlUnwind ReadFile GetStartupInfoW SetEndOfFile IsValidCodePage WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW

user32

GetWindowLongW GetCursorPos UpdateWindow GetDesktopWindow PeekMessageA GetKeyState ScreenToClient ClientToScreen GetKeyboardLayout SetCursor GetClientRect SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData SetWindowLongW GetWindowThreadProcessId DefWindowProcW GetWindowRect DestroyWindow IsWindowVisible SetWindowPos GetSystemMetrics SetWindowTextW RegisterClassExW ShowWindow GetKeyNameTextA GetAsyncKeyState DispatchMessageW MapVirtualKeyA GetForegroundWindow EnumWindows SetLayeredWindowAttributes TranslateMessage LoadCursorW PostQuitMessage

advapi32

OpenProcessToken CreateProcessAsUserW SetThreadToken GetTokenInformation SetTokenInformation LookupPrivilegeValueW RevertToSelf PrivilegeCheck DuplicateTokenEx

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmSetCompositionWindow

Name

.text

Size

524KB

Virtual Size

524KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

345KB

Virtual Size

344KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_43bdcea332dba1920df372f1bbc307f8_cobalt-strike_icedid_njrat_stealc

d3d9

kernel32

user32

advapi32

dwmapi

imm32

generic