2026-10-31_99a63eb4b4b44f159994a0ee8012ea95_cobalt-strike_icedid_njrat

General

Target
2026-10-31_99a63eb4b4b44f159994a0ee8012ea95_cobalt-strike_icedid_njrat
Size 3.8MB
Sample261101-2evkkadw6v
SHA256 cbc8d4acffa4b49d0df61c2c0335971cdcbf7078ea49d0277a4e31f55827a5b3
MD5 99a63eb4b4b44f159994a0ee8012ea95
SHA1 9bb4204380c4f0dba59232f83252ce492211a4f9
SHA512 94aac66438c7267da51f887f907187d2d053db0c811e725fe369f011633623a7d0d4ef27070108d406d563216a5e44c394fe20e8702d2c107244d0eb20f75d62
SSDEEP 49152:l+YE1SutHfUMkUY0VBDSkdWeBptBVev0jZCnG0H6A//HhXXchGHHJAKxcPJMands:gYN70VBzdlHIvhnV/JXX6GcOxGM
TLSH
T18F06BE86E3E200E9C5678035C2979B07FB71781953905BB726D18A297F23BF07E2B725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-31_99a63eb4b4b44f159994a0ee8012ea95_cobalt-strike_icedid_njrat

File Explorer

2026-10-31_99a63eb4b4b44f159994a0ee8012ea95_cobalt-strike_icedid_njrat

.exe 3.8MB

2026-10-31_99a63eb4b4b44f159994a0ee8012ea95_cobalt-strike_icedid_njrat

IMPHASH bd2905385fceb0e6362a821d4e8fbc4d
SHA256 cbc8d4acffa4b49d0df61c2c0335971cdcbf7078ea49d0277a4e31f55827a5b3
MD5 99a63eb4b4b44f159994a0ee8012ea95
SHA1 9bb4204380c4f0dba59232f83252ce492211a4f9
SHA512 94aac66438c7267da51f887f907187d2d053db0c811e725fe369f011633623a7d0d4ef27070108d406d563216a5e44c394fe20e8702d2c107244d0eb20f75d62
SSDEEP 49152:l+YE1SutHfUMkUY0VBDSkdWeBptBVev0jZCnG0H6A//HhXXchGHHJAKxcPJMands:gYN70VBzdlHIvhnV/JXX6GcOxGM
TLSH
T18F06BE86E3E200E9C5678035C2979B07FB71781953905BB726D18A297F23BF07E2B725
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2789664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

bcrypt

BCryptGenRandom BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider

psapi

GetProcessMemoryInfo

shell32

CommandLineToArgvW

kernel32

CreateThread SetEndOfFile PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleMode GetProcessHeap GetStringTypeW GetCurrentThread GetModuleHandleW GetProcAddress MultiByteToWideChar ReleaseSRWLockExclusive AcquireSRWLockExclusive GetFullPathNameW InitializeSRWLock WideCharToMultiByte CloseHandle GetLastError InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW WaitForSingleObjectEx WakeAllConditionVariable GetCommandLineW GetModuleFileNameW LocalFree SetDllDirectoryA GetStdHandle PeekNamedPipe Sleep GetProcessTimes GetCurrentProcess GetConsoleMode SetConsoleCtrlHandler InitOnceBeginInitialize InitOnceComplete WriteConsoleW GetConsoleScreenBufferInfo SetConsoleTextAttribute GetSystemTimeAsFileTime GetProcessAffinityMask EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ReleaseSemaphore WaitForSingleObject CreateEventW CreateSemaphoreW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW SetEnvironmentVariableW RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader IsProcessorFeaturePresent RtlUnwind ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW ExitProcess TerminateProcess CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType SystemTimeToTzSpecificLocalTime FileTimeToSystemTime QueryPerformanceFrequency ReadFile GetTimeZoneInformation DeleteFileW MoveFileExW WriteFile GetCommandLineA ReadConsoleW GetConsoleOutputCP GetConsoleCP DuplicateHandle RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc SetStdHandle VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW FlushFileBuffers GetFileSizeEx SetFilePointerEx GetCurrentDirectoryW HeapReAlloc HeapSize HeapQueryInformation OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW

Name

.text

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

826KB

Virtual Size

825KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-31_99a63eb4b4b44f159994a0ee8012ea95_cobalt-strike_icedid_njrat

bcrypt

psapi

shell32

kernel32

generic