2026-05-04_42e36670527da47c48acff5ade58b6f3_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-04_42e36670527da47c48acff5ade58b6f3_cobalt-strike_icedid_luca-stealer_njrat
Size 544KB
Sample260504-mv5cdahs2w
SHA256 1398a7d5b1d9cc7fde20f8dc8a94e02f6f9093b30cd10455cabdea98e7cc1f38
MD5 42e36670527da47c48acff5ade58b6f3
SHA1 c45d28467ce775a8ae9f262307358e992222e9cf
SHA512 143738d3a84437049c9db7e3365a8aa146e3a8684fec104c0544cfa0ab767d2e688841b8e3a66c832c5d5b285ca41218227d6eac19202d2373ad51e68dbfce57
SSDEEP 12288:FfQRmwAgvOHwMYhFgDyTPsrcXJSGLWJ8XCpqpNDv:FYReiOHj665GLWJcma
TLSH
T1B9C4DF01B3E102F9E1B746788AB6865AEB72BC211735DB9F039479A90F337D14E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-04_42e36670527da47c48acff5ade58b6f3_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-05-04_42e36670527da47c48acff5ade58b6f3_cobalt-strike_icedid_luca-stealer_njrat

.exe 544KB

2026-05-04_42e36670527da47c48acff5ade58b6f3_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 0d0e4f6531635752e8d468f54994f401
SHA256 1398a7d5b1d9cc7fde20f8dc8a94e02f6f9093b30cd10455cabdea98e7cc1f38
MD5 42e36670527da47c48acff5ade58b6f3
SHA1 c45d28467ce775a8ae9f262307358e992222e9cf
SHA512 143738d3a84437049c9db7e3365a8aa146e3a8684fec104c0544cfa0ab767d2e688841b8e3a66c832c5d5b285ca41218227d6eac19202d2373ad51e68dbfce57
SSDEEP 12288:FfQRmwAgvOHwMYhFgDyTPsrcXJSGLWJ8XCpqpNDv:FYReiOHj665GLWJcma
TLSH
T1B9C4DF01B3E102F9E1B746788AB6865AEB72BC211735DB9F039479A90F337D14E39721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\KbdEdit\LicensedBuilds\Tmp\26.2.0_premium_3585_pedronavf-gmail.com_3801\Build\Release_x64\KbdEditServer.pdb

advapi32

InitializeSecurityDescriptor SetSecurityDescriptorDacl DuplicateTokenEx CreateProcessAsUserW RegQueryValueExW ReportEventW RegisterEventSourceW OpenServiceW ChangeServiceConfigW StartServiceCtrlDispatcherW RegOpenKeyExW StartServiceW RegSetValueExW ControlService RegisterServiceCtrlHandlerW DeleteService ChangeServiceConfig2W SetServiceStatus OpenSCManagerW CloseServiceHandle QueryServiceStatus RegCloseKey CreateServiceW DeregisterEventSource

shell32

CommandLineToArgvW

wtsapi32

WTSQueryUserToken WTSSendMessageW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

kernel32

SetEndOfFile WriteConsoleW HeapSize CreateFileW GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW ReadFile lstrlenW WriteFile lstrcpynW CreateNamedPipeW WaitForMultipleObjects LocalAlloc DisconnectNamedPipe CreateEventW GetLastError SetEvent CloseHandle ResetEvent GetOverlappedResult LocalFree lstrcpyW ConnectNamedPipe FindFirstFileW TerminateProcess GetTempPathW FindClose WaitForSingleObject GetCurrentThreadId ResumeThread Sleep TerminateThread DeleteFileW WTSGetActiveConsoleSessionId CreateProcessW GetTempFileNameW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection SetConsoleCtrlHandler GetCommandLineW GetModuleFileNameW FormatMessageW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW QueryPerformanceCounter GetCurrentProcess GetProcAddress GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle GetCommandLineA HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx GetTimeZoneInformation ReadConsoleW FlushFileBuffers HeapReAlloc FindFirstFileExW

user32

wsprintfW WaitForInputIdle MessageBoxW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

Name

.text

Size

166KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

346KB

Virtual Size

346KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-04_42e36670527da47c48acff5ade58b6f3_cobalt-strike_icedid_luca-stealer_njrat

advapi32

shell32

wtsapi32

userenv

kernel32

user32

version

generic