2026-06-01_8c8bda635830ca1231a5958f9e4ea4b0_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-01_8c8bda635830ca1231a5958f9e4ea4b0_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 423KB
Sample260601-e1wcnaev9k
SHA256 8eaa5ea0be47980320b36e98a083e9b3565acc9eb4250cdc41614f600a314c0c
MD5 8c8bda635830ca1231a5958f9e4ea4b0
SHA1 ca72a3b6030886e5a3fdbedbc1a281efce51cbf7
SHA512 f2d1273017c8453872c35ae82d81edcd0b1e9e025e8c4cf718c1102561ee6a464034a30977474046b06e3dcbe5ade6e0297689c323707cffa2c926e5b4701160
SSDEEP 6144:vexjCEELRdq261+d4qO6uvXpOOtXmKGR2Ndt5PJPKkwCeyqMPn2:vUGWWd4qOXvJtXm12NrCkNqMn2
TLSH
T1E4948D5AF76400F9D16BD138CD534546EB71BC4A4760EACF13985AAA2F336E08E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-06-01_8c8bda635830ca1231a5958f9e4ea4b0_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-06-01_8c8bda635830ca1231a5958f9e4ea4b0_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 423KB

2026-06-01_8c8bda635830ca1231a5958f9e4ea4b0_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH f04dcf059295267aad79484bcbab1a3d
SHA256 8eaa5ea0be47980320b36e98a083e9b3565acc9eb4250cdc41614f600a314c0c
MD5 8c8bda635830ca1231a5958f9e4ea4b0
SHA1 ca72a3b6030886e5a3fdbedbc1a281efce51cbf7
SHA512 f2d1273017c8453872c35ae82d81edcd0b1e9e025e8c4cf718c1102561ee6a464034a30977474046b06e3dcbe5ade6e0297689c323707cffa2c926e5b4701160
SSDEEP 6144:vexjCEELRdq261+d4qO6uvXpOOtXmKGR2Ndt5PJPKkwCeyqMPn2:vUGWWd4qOXvJtXm12NrCkNqMn2
TLSH
T1E4948D5AF76400F9D16BD138CD534546EB71BC4A4760EACF13985AAA2F336E08E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

7f:eb:6d:c6:70:57:73:96:fd:38:d4:01:12:57:ec:ad:b8:4c:cc:c2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=上海兆言网络科技有限公司,O=上海兆言网络科技有限公司,ST=Shanghai,C=CN

Chains

Mar 25, 2026

CN=上海兆言网络科技有限公司,O=上海兆言网络科技有限公司,ST=Shanghai,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=上海兆言网络科技有限公司,O=上海兆言网络科技有限公司,ST=Shanghai,C=CN

Serial Number

06:52:18:e7:f5:61:68:03:f9:02:a9:68:90:73:6f:cb

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 25, 2023 - May 8, 2026

Minor OS version

Major OS version

Entry point

127428

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\codes\memetao\GameHook\build_x64\graphics_capture\Release\graphics_capture.pdb

kernel32

LoadLibraryA GetLastError CreateFileA GetFileSizeEx GetCurrentProcess GetModuleHandleW MapViewOfFile UnmapViewOfFile OpenFileMappingA GetCurrentThreadId FormatMessageW LoadLibraryW RtlUnwind WriteConsoleW SetEndOfFile HeapSize GetProcAddress SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW ReadFile FlushFileBuffers FreeLibrary OpenMutexA CreateFileW CloseHandle DeleteFileW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive QueryPerformanceCounter QueryPerformanceFrequency EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetSystemTimeAsFileTime GetStringTypeW GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead InterlockedPushEntrySList RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetConsoleOutputCP GetConsoleMode SetFilePointerEx GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW

user32

GetMessageA MonitorFromWindow GetMonitorInfoW DisplayConfigGetDeviceInfo QueryDisplayConfig GetDisplayConfigBufferSizes LoadCursorA UpdateWindow GetSystemMetrics ShowWindow CreateWindowExA RegisterClassExA PostQuitMessage DefWindowProcA MonitorFromRect EnumDisplayDevicesW EnumDisplaySettingsExW KillTimer SetTimer IsWindow DispatchMessageA TranslateMessage

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueA

d3d11

CreateDirect3D11DeviceFromDXGIDevice D3D11CreateDevice

dxgi

CreateDXGIFactory1

winmm

timeBeginPeriod

ole32

CoInitializeEx CoCreateFreeThreadedMarshaler

oleaut32

SysFreeString SysAllocString GetErrorInfo SetErrorInfo SysStringLen

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-01_8c8bda635830ca1231a5958f9e4ea4b0_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

advapi32

d3d11

dxgi

winmm

ole32

oleaut32

generic