2026-05-28_9b44747c6466ab067ef2cebfc0add53b_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-28_9b44747c6466ab067ef2cebfc0add53b_cobalt-strike_icedid_luca-stealer_njrat
Size 327KB
Sample260528-mde16acy2p
SHA256 01cc53420932274ff52691a4c85dc539d0ba543e187e56c7440db2611486995b
MD5 9b44747c6466ab067ef2cebfc0add53b
SHA1 f66ad69af62f1ef81ed1494190d173ee75cb46c8
SHA512 06df110fdc11cd2f3dd53167b9b1fe733bacf84294213a19644728186466c29c95586af616092ebad87d6699669a7e9326b01d1f6d51c8f72980c33fbe7ec8d4
SSDEEP 3072:D6V4bDKEMdUcbOWOInR48xwTKMCTFwJG8514t3Lf4Bnld45110AVjaNDaN48WwBg:Y4jMdTKBorwTlCTAV54YlMYBRx+Fc9q
TLSH
T1BD64AF55A3E518F6ECB3813EC9528607E7B2B8460720DB9F13B446156F237D1AE3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_9b44747c6466ab067ef2cebfc0add53b_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-05-28_9b44747c6466ab067ef2cebfc0add53b_cobalt-strike_icedid_luca-stealer_njrat

.exe 327KB

2026-05-28_9b44747c6466ab067ef2cebfc0add53b_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH f4e3348f8c9fb3bec2332a420886e67e
SHA256 01cc53420932274ff52691a4c85dc539d0ba543e187e56c7440db2611486995b
MD5 9b44747c6466ab067ef2cebfc0add53b
SHA1 f66ad69af62f1ef81ed1494190d173ee75cb46c8
SHA512 06df110fdc11cd2f3dd53167b9b1fe733bacf84294213a19644728186466c29c95586af616092ebad87d6699669a7e9326b01d1f6d51c8f72980c33fbe7ec8d4
SSDEEP 3072:D6V4bDKEMdUcbOWOInR48xwTKMCTFwJG8514t3Lf4Bnld45110AVjaNDaN48WwBg:Y4jMdTKBorwTlCTAV54YlMYBRx+Fc9q
TLSH
T1BD64AF55A3E518F6ECB3813EC9528607E7B2B8460720DB9F13B446156F237D1AE3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

79328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\fuze\ragemp\driver\KDU-1.4.7\Source\Hamakaze\output\x64\Release\qqq123.pdb

kernel32

WriteProcessMemory ResumeThread UnmapViewOfFile DeleteFileW CreateProcessW GetModuleHandleW GetCurrentProcessId ReadFile WriteFile SetFilePointer TerminateProcess Sleep VirtualUnlock VirtualLock TerminateThread CreateThread HeapSetInformation GetProcAddress FreeLibrary SetDllDirectoryW LoadLibraryExW VirtualFree CreateEventW GetProcessHeap GetConsoleScreenBufferInfo SetConsoleTextAttribute GetCommandLineW GetStdHandle GetModuleFileNameW CreateFileW FormatMessageW GetSystemInfo VirtualAllocEx ReadProcessMemory GetSystemTimeAsFileTime VirtualFreeEx CreateFileMappingW MapViewOfFile GetFirmwareEnvironmentVariableW ExpandEnvironmentStringsW LoadLibraryW GetCurrentDirectoryW WriteConsoleW HeapDestroy HeapAlloc HeapCreate RtlCompareMemory CloseHandle WaitForSingleObject GetLastError GetCurrentProcess HeapReAlloc HeapSize GetFileSizeEx VirtualAlloc SetFilePointerEx GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree GetCommandLineA GetModuleHandleExW ExitProcess RtlPcToFileHeader RaiseException EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetCurrentThreadId QueryPerformanceCounter GetStartupInfoW SetLastError

advapi32

RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegCloseKey RegDeleteKeyW RegQueryValueExW RegEnumKeyExW

ntdll

NtWaitForSingleObject NtTerminateProcess RtlTimeToSecondsSince1970 NtSetValueKey NtOpenSection NtQueryObject RtlLengthRequiredSid RtlNtdllName NtDuplicateObject RtlAdjustPrivilege RtlEqualUnicodeString LdrGetProcedureAddress NtSetSecurityObject RtlDoesFileExists_U NtCreateMutant RtlGetVersion LdrUnloadDll NtAlpcDisconnectPort RtlCreateSecurityDescriptor NtAlpcCreatePort NtAlpcAcceptConnectPort RtlAddAccessAllowedAce RtlLengthSid NtReplyWaitReceivePort RtlSetDaclSecurityDescriptor RtlSubAuthoritySid RtlInitializeSid NtDeviceIoControlFile NtLoadDriver NtUnloadDriver NtOpenKey NtMapViewOfSection NtUnmapViewOfSection LdrLoadDll NtCreateSection LdrAccessResource RtlSetLastWin32Error NtCreateFile RtlNtStatusToDosError RtlEqualSid RtlInitString RtlFreeHeap NtQueryDirectoryObject RtlFreeSid RtlExpandEnvironmentStrings NtOpenDirectoryObject NtFlushBuffersFile RtlUnicodeStringToAnsiString NtClose NtQueryInformationToken RtlAllocateAndInitializeSid LdrFindResource_U RtlDosPathNameToNtPathName_U RtlInitUnicodeString NtOpenProcess RtlFreeUnicodeString NtQueryInformationProcess NtWriteFile NtQuerySystemInformation RtlAllocateHeap NtFreeVirtualMemory NtOpenProcessToken RtlFreeAnsiString NtAdjustPrivilegesToken RtlImageNtHeader RtlCreateAcl

rpcrt4

UuidCreate

setupapi

SetupDiCallClassInstaller SetupDiCreateDeviceInfoW SetupDiDestroyDeviceInfoList InstallHinfSectionW SetupDiSetDeviceRegistryPropertyW SetupDiCreateDeviceInfoList SetupDiGetINFClassW SetupDiRemoveDevice

newdev

UpdateDriverForPlugAndPlayDevicesW

bcrypt

BCryptDestroyKey BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptEncrypt

fltlib

FilterSendMessage FilterConnectCommunicationPort

msdelta

DeltaFree ApplyDeltaB

Name

.text

Size

169KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_9b44747c6466ab067ef2cebfc0add53b_cobalt-strike_icedid_luca-stealer_njrat

kernel32

advapi32

ntdll

rpcrt4

setupapi

newdev

bcrypt

fltlib

msdelta

generic