2026-07-20_4f7ba2807ce87a99dde54103e0d38921_cobalt-strike_icedid_luca-stealer_njrat

General

Target
2026-07-20_4f7ba2807ce87a99dde54103e0d38921_cobalt-strike_icedid_luca-stealer_njrat
Size 171KB
Sample260720-dpklcags8t
SHA256 090e769787ae143e7b9fe31519cc5836c78bd20923a91b3a25b8bc1627568b29
MD5 4f7ba2807ce87a99dde54103e0d38921
SHA1 06ccdb3c045f2c4e35f1393c5f27fbc73be57fbf
SHA512 ca50f5ede9105840e1042c097febb9d336f64b4979a640442a21f48efffee9fe6f43fbe4dd598fc9b125432c1d17e14e807e91ae379b0cabec375b38568c6636
SSDEEP 3072:e1X5fqAEgQSt3wFDx5IqoJHmmQyxp7kE/XxKdZ89e0:eKvSt3wT9mQupawL
TLSH
T1FE048E5673E510F9F1B38239C9614A46E772782207609BDF03A44776AF232E19D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-20_4f7ba2807ce87a99dde54103e0d38921_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-07-20_4f7ba2807ce87a99dde54103e0d38921_cobalt-strike_icedid_luca-stealer_njrat

.exe 171KB

2026-07-20_4f7ba2807ce87a99dde54103e0d38921_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 67a52d06bf47f13d326f2b04b73c0aa9
SHA256 090e769787ae143e7b9fe31519cc5836c78bd20923a91b3a25b8bc1627568b29
MD5 4f7ba2807ce87a99dde54103e0d38921
SHA1 06ccdb3c045f2c4e35f1393c5f27fbc73be57fbf
SHA512 ca50f5ede9105840e1042c097febb9d336f64b4979a640442a21f48efffee9fe6f43fbe4dd598fc9b125432c1d17e14e807e91ae379b0cabec375b38568c6636
SSDEEP 3072:e1X5fqAEgQSt3wFDx5IqoJHmmQyxp7kE/XxKdZ89e0:eKvSt3wT9mQupawL
TLSH
T1FE048E5673E510F9F1B38239C9614A46E772782207609BDF03A44776AF232E19D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\tc2\tc2\src\utils\vrad_launcher\Release\x64\vrad.pdb

tier0

ThreadWaitForObjects ReleaseThreadHandle Plat_IsInDebugSession ?DevWarning@@YAXPEBDZZ GetThreadedLoadLibraryFunc Error CreateSimpleThread CommandLine_Tier0

kernel32

GetFullPathNameW WriteConsoleW FormatMessageA GetLastError LocalFree MultiByteToWideChar WideCharToMultiByte LoadLibraryExA GetProcAddress FreeLibrary RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW ReadConsoleW ReadFile SetEndOfFile HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers CreateFileW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer GetDriveTypeW SetEnvironmentVariableW GetCurrentDirectoryW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType CloseHandle HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW GetProcessHeap

Name

.text

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-20_4f7ba2807ce87a99dde54103e0d38921_cobalt-strike_icedid_luca-stealer_njrat

tier0

kernel32

generic