2026-07-12_854eaa423aa3ef2f75c16c580d469ebc_cobalt-strike_icedid_luca-stealer_njrat

General

Target
2026-07-12_854eaa423aa3ef2f75c16c580d469ebc_cobalt-strike_icedid_luca-stealer_njrat
Size 157KB
Sample260712-ppkrwsby7x
SHA256 b32e437760b6d400150349c37b239e4d943d47f2ae70c11cee8c2c77954ca631
MD5 854eaa423aa3ef2f75c16c580d469ebc
SHA1 87dda5ce5fb070bacdb5ac8eed9dea740a869fad
SHA512 12f8d5415e21141145ec466254590a9be546be2ce554eb3453166aa38a06496a57ebf57006489103deadc8d5a7b63dab49b99b998f501fcde695cef6af2a7b5e
SSDEEP 1536:xIKSvvqyg9ZHroF2UXuTfNRdm3Cx6GGtMTHtSuWAdD6xWVlI36vGsWqdoB9dle6U:x4SFx5S3C6tANhhdD6xWVuKPAI6pD
TLSH
T118F34A5B77E231F9E1B7823989A14646F7727C7107209BEF13A456761F232D09E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-12_854eaa423aa3ef2f75c16c580d469ebc_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-07-12_854eaa423aa3ef2f75c16c580d469ebc_cobalt-strike_icedid_luca-stealer_njrat

.exe 157KB

2026-07-12_854eaa423aa3ef2f75c16c580d469ebc_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH f429da6b33a18b38002eaef0f719f714
SHA256 b32e437760b6d400150349c37b239e4d943d47f2ae70c11cee8c2c77954ca631
MD5 854eaa423aa3ef2f75c16c580d469ebc
SHA1 87dda5ce5fb070bacdb5ac8eed9dea740a869fad
SHA512 12f8d5415e21141145ec466254590a9be546be2ce554eb3453166aa38a06496a57ebf57006489103deadc8d5a7b63dab49b99b998f501fcde695cef6af2a7b5e
SSDEEP 1536:xIKSvvqyg9ZHroF2UXuTfNRdm3Cx6GGtMTHtSuWAdD6xWVlI36vGsWqdoB9dle6U:x4SFx5S3C6tANhhdD6xWVuKPAI6pD
TLSH
T118F34A5B77E231F9E1B7823989A14646F7727C7107209BEF13A456761F232D09E3AB20
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

8240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rpcrt4

NdrAsyncClientCall RpcAsyncCompleteCall RpcAsyncInitializeHandle RpcBindingSetAuthInfoExW RpcStringFreeW RpcStringBindingComposeW RpcBindingFromStringBindingW RpcBindingFree NdrOleFree NdrOleAllocate

ntdll

RtlUnwindEx RtlPcToFileHeader NtClose DbgUiSetThreadDebugObject NtDuplicateObject NtRemoveProcessDebug NtQueryInformationProcess

advapi32

CreateWellKnownSid

kernel32

GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte FlushFileBuffers WriteConsoleW CreateFileW HeapReAlloc HeapSize SetFilePointerEx MultiByteToWideChar InitializeCriticalSectionAndSpinCount ContinueDebugEvent WaitForDebugEvent DebugActiveProcessStop CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap WaitForSingleObject CreateEventA GetCurrentProcess TerminateProcess ResumeThread CreateProcessW InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetSystemDirectoryW GetWindowsDirectoryW LocalAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetCPInfo GetFileSizeEx GetConsoleMode SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetOEMCP TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetConsoleOutputCP

Name

.text

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

8KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-12_854eaa423aa3ef2f75c16c580d469ebc_cobalt-strike_icedid_luca-stealer_njrat

rpcrt4

ntdll

advapi32

kernel32

generic