2026-11-11_4834a15b48a68f7eeda197bb72061916_cobalt-strike_icedid_njrat

General

Target
2026-11-11_4834a15b48a68f7eeda197bb72061916_cobalt-strike_icedid_njrat
Size 375KB
Sample261113-qech7sb12v
SHA256 62eabfb9c67d7f085a7b7c835faa2b8a6fb8a008f32043c2334c2e6122610c3a
MD5 4834a15b48a68f7eeda197bb72061916
SHA1 0b10ac2abb785dcd3ef4f532c6e071c55803e510
SHA512 250a9c5762d71666c81deb80ffb50b8e9b45434fbb488f92a3b3c1cab83d53cb9bb213f8bf1a78011768aa8d734a3b72ae3a949f4fd4088380fce34073fd0e60
SSDEEP 6144:e9Uiae7W1ziXhDgKpAbN2aQWoH4cw3IT9Wm:e9dV7W1ziXhDgKpAR0TUm
TLSH
T12084A45AFBF610E4E5BAC13895A2312AFC7138A54738EBD79685460B1B30BE4ED3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-11_4834a15b48a68f7eeda197bb72061916_cobalt-strike_icedid_njrat

File Explorer

2026-11-11_4834a15b48a68f7eeda197bb72061916_cobalt-strike_icedid_njrat

.exe 375KB

2026-11-11_4834a15b48a68f7eeda197bb72061916_cobalt-strike_icedid_njrat

IMPHASH e497fb5571a7f5cde13bf6da110e6cf0
SHA256 62eabfb9c67d7f085a7b7c835faa2b8a6fb8a008f32043c2334c2e6122610c3a
MD5 4834a15b48a68f7eeda197bb72061916
SHA1 0b10ac2abb785dcd3ef4f532c6e071c55803e510
SHA512 250a9c5762d71666c81deb80ffb50b8e9b45434fbb488f92a3b3c1cab83d53cb9bb213f8bf1a78011768aa8d734a3b72ae3a949f4fd4088380fce34073fd0e60
SSDEEP 6144:e9Uiae7W1ziXhDgKpAbN2aQWoH4cw3IT9Wm:e9dV7W1ziXhDgKpAR0TUm
TLSH
T12084A45AFBF610E4E5BAC13895A2312AFC7138A54738EBD79685460B1B30BE4ED3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WriteProcessMemory CreateToolhelp32Snapshot CloseHandle VirtualProtectEx VirtualAllocEx ReadProcessMemory VirtualFreeEx VirtualFree VirtualAlloc Module32First CreateFileW OpenProcess Sleep LoadLibraryW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx HeapQueryInformation HeapReAlloc HeapFree GetStringTypeW SetStdHandle GetProcessHeap EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetModuleFileNameW GetModuleHandleExW ExitProcess GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapSize HeapValidate GetSystemInfo GetFileType OutputDebugStringW WriteConsoleW FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW

user32

FindWindowA UnhookWindowsHookEx SetWindowsHookExA PostThreadMessageA GetWindowThreadProcessId

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlImageNtHeader

Name

.text

Size

269KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_4834a15b48a68f7eeda197bb72061916_cobalt-strike_icedid_njrat

kernel32

user32

ntdll

generic