2026-10-26_642bd310246da09dbac707bf67f34b6d_cobalt-strike_icedid_njrat_ryuk_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-26_642bd310246da09dbac707bf67f34b6d_cobalt-strike_icedid_njrat_ryuk_stealc
Size 29.9MB
Sample261027-s92spae18q
SHA256 19f2a0bad214162aa37c8abdd7b2eaa07917226454c5009004d3143d372eebc3
MD5 642bd310246da09dbac707bf67f34b6d
SHA1 b0895acf91aef6ff95f30a5ff9119a27f05ffb9c
SHA512 99744c53ecf9b0950ad10880bd791e6434d446ce9c5fbfcaf294592e35dc7f1b39aa16f548c42d96c5c6211df834366e84bda4236448cdebfddac68c87584bb4
SSDEEP 196608:5zw47iZ7P0KF/I2nPENB8FF2RJZ4/rELlNvPflMY2G4hbLDZdCETVMQ:5E+iBSwLFF2RJZ4/rEZlt2G4NZdbVMQ
TLSH
T15B67E9117B4668AEC58ACCB183464A721E2434DB1F36FDEF448495392FBDAF51F38628
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-26_642bd310246da09dbac707bf67f34b6d_cobalt-strike_icedid_njrat_ryuk_stealc

File Explorer

2026-10-26_642bd310246da09dbac707bf67f34b6d_cobalt-strike_icedid_njrat_ryuk_stealc

.exe 29.9MB

2026-10-26_642bd310246da09dbac707bf67f34b6d_cobalt-strike_icedid_njrat_ryuk_stealc

IMPHASH fcf7919d59bd8b45a52a793ecd3c5f6d
SHA256 19f2a0bad214162aa37c8abdd7b2eaa07917226454c5009004d3143d372eebc3
MD5 642bd310246da09dbac707bf67f34b6d
SHA1 b0895acf91aef6ff95f30a5ff9119a27f05ffb9c
SHA512 99744c53ecf9b0950ad10880bd791e6434d446ce9c5fbfcaf294592e35dc7f1b39aa16f548c42d96c5c6211df834366e84bda4236448cdebfddac68c87584bb4
SSDEEP 196608:5zw47iZ7P0KF/I2nPENB8FF2RJZ4/rELlNvPflMY2G4hbLDZdCETVMQ:5E+iBSwLFF2RJZ4/rEZlt2G4NZdbVMQ
TLSH
T15B67E9117B4668AEC58ACCB183464A721E2434DB1F36FDEF448495392FBDAF51F38628
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22731556

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\porch\Desktop\astra tools\Build\Development\AstraTools.pdb

bcrypt

BCryptCloseAlgorithmProvider BCryptHash BCryptOpenAlgorithmProvider

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI CloseHandle CompareStringEx CompareStringW CopyFile2 CreateDirectoryExW CreateDirectoryW CreateFile2 CreateFileW CreateHardLinkW CreateSymbolicLinkW CreateThread DecodePointer DeleteCriticalSection DeviceIoControl EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileA FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetExitCodeThread GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetTickCount64 GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LocalFree MoveFileExW MultiByteToWideChar OutputDebugStringW PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive ReleaseSRWLockShared ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetEnvironmentVariableW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread SystemTimeToTzSpecificLocalTime TerminateProcess TryAcquireSRWLockExclusive TryAcquireSRWLockShared UnhandledExceptionFilter VirtualProtect WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

dbghelp

SymFromAddr SymGetLineFromAddr64 SymInitialize SymSetOptions

Name

.text

Size

22.2MB

Virtual Size

22.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

188KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

29B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_guard_c

Size

512B

Virtual Size

36B

Characteristics

Name

_guard_d

Size

512B

Virtual Size

36B

Characteristics

Name

memcpy_

Size

512B

Virtual Size

264B

Characteristics

Name

.rsrc

Size

512B

Virtual Size

408B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-26_642bd310246da09dbac707bf67f34b6d_cobalt-strike_icedid_njrat_ryuk_stealc

bcrypt

kernel32

dbghelp

generic