2026-07-16_5d5b2be124d328017a15da162c0cdc25_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-16_5d5b2be124d328017a15da162c0cdc25_cobalt-strike_icedid_luca-stealer_njrat
Size 823KB
Sample260716-jldarabw2x
SHA256 5ae30acecf73fc5351c482f2c6a838ff6f9f0c7e700b3d811ab7c9ad879e4662
MD5 5d5b2be124d328017a15da162c0cdc25
SHA1 847748e3a0372aff1b5d8eb2895531776224173b
SHA512 1e84ff46a6f051faeb74dd81010c12dc8fad13e0106497885120f30e9b671270445cd687ed08121dd032a621ae752dd2277968da25696bc6338e71d6c5ba355e
SSDEEP 12288:+1ShiXkiGMwmGAalkBCPi995rA5d1q9G0Whwrg8d45v183wh:UsiXFGMwtRkBCC91AdqY0WhOdF3+
TLSH
T118059F5977A452E5E077D139CA569AD6FAB27C054724A7C703F06BAA3F233D00A3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-16_5d5b2be124d328017a15da162c0cdc25_cobalt-strike_icedid_luca-stealer_njrat

.exe 823KB

2026-07-16_5d5b2be124d328017a15da162c0cdc25_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 148575c704cbce692f9b0e51d54eae4d
SHA256 5ae30acecf73fc5351c482f2c6a838ff6f9f0c7e700b3d811ab7c9ad879e4662
MD5 5d5b2be124d328017a15da162c0cdc25
SHA1 847748e3a0372aff1b5d8eb2895531776224173b
SHA512 1e84ff46a6f051faeb74dd81010c12dc8fad13e0106497885120f30e9b671270445cd687ed08121dd032a621ae752dd2277968da25696bc6338e71d6c5ba355e
SSDEEP 12288:+1ShiXkiGMwmGAalkBCPi995rA5d1q9G0Whwrg8d45v183wh:UsiXFGMwtRkBCC91AdqY0WhOdF3+
TLSH
T118059F5977A452E5E077D139CA569AD6FAB27C054724A7C703F06BAA3F233D00A3E312
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

d6:f1:e1:ae:15:ec:fd:a4:78:2a:f8:e2:72:3b:33:4d:8d:86:79:0a:af:17:e2:5d:9d:71:18:78:2d:f4:1a:ea

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

Chains

Jul 15, 2026

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=SignPath Foundation,O=SignPath Foundation,L=Lewes,ST=Delaware,C=US

Serial Number

2f:52:e1:17:43:aa:52:47:3c:ff:7c:42

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 15, 2025 - Sep 7, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

60464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\teraterm\teraterm\teraterm\Release.x64\keycode.pdb

kernel32

HeapSize GetProcAddress GetModuleHandleA WriteConsoleW FlushFileBuffers SetEndOfFile GetProcessHeap MulDiv CreateDirectoryW GetLastError Sleep GetCurrentProcessId GetTickCount GetConsoleTitleA SetConsoleTitleA MultiByteToWideChar FreeResource LoadResource LockResource FindResourceW GetFileAttributesW OutputDebugStringA GetSystemTime GetLocalTime GetPrivateProfileStringW CreateFileA CreateFileW FindClose FindFirstFileW FindNextFileW GetFileSize CloseHandle GetCurrentThreadId CreateProcessW GetStartupInfoW GlobalAlloc GlobalSize GlobalUnlock GlobalLock CopyFileW GetACP OutputDebugStringW WideCharToMultiByte GetSystemDirectoryW FreeLibrary GetModuleFileNameW GetModuleHandleW LoadLibraryW ExpandEnvironmentStringsW GetCurrentDirectoryW GetFullPathNameW SetLastError LocalFree FormatMessageW FileTimeToSystemTime SetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime SetFileTime TzSpecificLocalTimeToSystemTime SystemTimeToFileTime GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetCurrentThread GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber InitializeCriticalSectionEx VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle GetTimeZoneInformation HeapReAlloc GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx SetConsoleCtrlHandler ReadFile ReadConsoleW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW RtlUnwind

user32

CheckDlgButton IsDlgButtonChecked SendDlgItemMessageW EnableWindow GetSystemMetrics GetDC ReleaseDC GetWindowLongPtrA SetWindowLongPtrW GetDesktopWindow GetClassNameA DestroyIcon LoadImageW wsprintfA FindWindowA SendDlgItemMessageA ModifyMenuW SetWindowTextW PostMessageW CallWindowProcW GetWindowTextW GetWindowTextLengthW GetWindowLongPtrW SetWindowLongPtrA GetClassLongPtrA SetClassLongPtrA GetParent GetWindow CharNextA CharPrevA SystemParametersInfoA OpenClipboard CloseClipboard SetClipboardData GetDlgItem EmptyClipboard GetPriorityClipboardFormat GetSubMenu GetMenuItemID GetMenuItemCount InsertMenuA MessageBoxW SystemParametersInfoW CreateWindowExW DestroyWindow SetWindowPos GetWindowPlacement IsWindowVisible IsIconic GetClientRect GetWindowRect ClientToScreen GetWindowLongW GetMenuStringW MessageBoxA InvalidateRect EndPaint BeginPaint KillTimer SetTimer GetKeyState ShowWindow CreateWindowExA RegisterClassA PostQuitMessage DefWindowProcA DispatchMessageA TranslateMessage GetMessageA SetDlgItemTextW EndDialog DialogBoxIndirectParamW CreateDialogIndirectParamW CallWindowProcA SendMessageW LoadCursorA SendMessageA GetClipboardData

gdi32

TextOutA EnumFontFamiliesExA EnumFontFamiliesExW DeleteObject GetTextMetricsA SelectObject GetTextExtentPoint32W GetDeviceCaps CreateFontIndirectW

setupapi

SetupDiGetDeviceInstanceIdA SetupDiGetDeviceRegistryPropertyA

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

SHBrowseForFolderW ShellExecuteA ShellExecuteW DragQueryFileW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetPathFromIDListEx

ole32

CoCreateInstance CoTaskMemFree

Name

.text

Size

577KB

Virtual Size

577KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-16_5d5b2be124d328017a15da162c0cdc25_cobalt-strike_icedid_luca-stealer_njrat

kernel32

user32

gdi32

setupapi

comdlg32

advapi32

shell32

ole32

generic