2026-07-07_81f77a1cc82222cc91d29d826bdf67a0_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-07_81f77a1cc82222cc91d29d826bdf67a0_cobalt-strike_icedid_luca-stealer_njrat
Size 305KB
Sample260707-jjwdjscy21
SHA256 ef03a17597f3a1d45e526587d4fa3df0947418432bff8a2ae17c69896a5fbbeb
MD5 81f77a1cc82222cc91d29d826bdf67a0
SHA1 f46ba1a5058d5703ebf79b6cdb4fd892505fe57f
SHA512 27386fce5095592b90e0ddfd15a2c62961e2f7848dde9c26c8dda90bf99d5b46f88ba8974576dca4cd37130ae54437254d06819b3b27b929877f7facab75cd6f
SSDEEP 6144:npcbXGf/t7xMXJYJreOhtw8rlxB6J36VV4L//FMAgFh7X/G:pcb2f17iSreOMCbB6J36VS//FNg77X/G
TLSH
T19C646CCA2661E0E2F2E34533F916D7B493317C21CBD056AB02D17A223D3AB81DE1B6D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-07-07_81f77a1cc82222cc91d29d826bdf67a0_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-07-07_81f77a1cc82222cc91d29d826bdf67a0_cobalt-strike_icedid_luca-stealer_njrat

.exe 305KB

2026-07-07_81f77a1cc82222cc91d29d826bdf67a0_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 3ed0613b97875c8c3626c7f088a0c66e
SHA256 ef03a17597f3a1d45e526587d4fa3df0947418432bff8a2ae17c69896a5fbbeb
MD5 81f77a1cc82222cc91d29d826bdf67a0
SHA1 f46ba1a5058d5703ebf79b6cdb4fd892505fe57f
SHA512 27386fce5095592b90e0ddfd15a2c62961e2f7848dde9c26c8dda90bf99d5b46f88ba8974576dca4cd37130ae54437254d06819b3b27b929877f7facab75cd6f
SSDEEP 6144:npcbXGf/t7xMXJYJreOhtw8rlxB6J36VV4L//FMAgFh7X/G:pcb2f17iSreOMCbB6J36VS//FNg77X/G
TLSH
T19C646CCA2661E0E2F2E34533F916D7B493317C21CBD056AB02D17A223D3AB81DE1B6D5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

8a:b4:6e:ba:d5:4a:2a:d7:ac:78:1c:7b:87:93:9f:2f:d4:fc:64:54:7c:0e:be:a3:4d:71:a2:69:9f:73:16:be

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

Chains

Jul 10, 2025

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Serial Number

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2021 - Nov 7, 2030

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Serial Number

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 7, 2021 - Dec 29, 2040

Subject

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Praha,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

Serial Number

31:9d:9d:48:1a:b6:f5:e0:92:bc:c5:e3:4f:f7:3c:5b

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2022 - Oct 11, 2025

Subject

CN=Entrust Time Stamping CA - TS2,O=Entrust\, Inc.,C=US

Serial Number

25:bc:2b:f3:29:ca:10:7f:1e:a9:ba:88:85:d4:9d:3b

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2021 - Dec 29, 2040

Subject

CN=Entrust Timestamp Authority - TSA2,O=Entrust\, Inc.,C=US

Serial Number

c5:14:f6:c9:51:75:ae:fe:76:01:db:b9:15:19:46:ba

Issuer

CN=Entrust Time Stamping CA - TS2,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 22, 2025 - Jan 18, 2030

Minor OS version

Major OS version

Entry point

6128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

wsprintfA

ole32

CoUninitialize CoInitializeEx

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

kernel32

HeapSize HeapReAlloc SetEndOfFile WriteConsoleW EncodePointer CreateDirectoryA GetFileAttributesA HeapAlloc HeapFree GetProcessHeap Sleep GlobalMemoryStatusEx GetSystemInfo GetTickCount LoadResource LockResource SizeofResource WinExec lstrcpyA FindResourceA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW ReadConsoleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW CloseHandle GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW FlushFileBuffers CreateFileW ReadFile

Name

.text

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-07_81f77a1cc82222cc91d29d826bdf67a0_cobalt-strike_icedid_luca-stealer_njrat

PE Signature issue

user32

ole32

advapi32

kernel32

generic