2026-07-22_0d2486add8d55dbcf14e85b8b1dd9cbd_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_0d2486add8d55dbcf14e85b8b1dd9cbd_cobalt-strike_icedid_luca-stealer_njrat
Size 403KB
Sample260723-ardzssed49
SHA256 9186bd0073440c45c9417ac7d2522c6e9abc7c3bab873347edb604c38f198529
MD5 0d2486add8d55dbcf14e85b8b1dd9cbd
SHA1 27d42208c624303a6f90eab0460ef000a4a00f8e
SHA512 5d475a3bee99deca0ac1c4a432651a8437201f8c794a95da8cee7e703211312daa69692a183a954e27aedb091b39e5959cf7e4781ed682bdbe8b76289bff7417
SSDEEP 6144:WKELA/njuvagzrUuIytV7f/kBRWqXk3jTPvZWsFo5:WKiUMag/UuIkRHTPBRFQ
TLSH
T1BE94AE56D3E525E5E8A38139C952C603E7B2BC560720DB9F12A076593F333D1AE3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_0d2486add8d55dbcf14e85b8b1dd9cbd_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-07-22_0d2486add8d55dbcf14e85b8b1dd9cbd_cobalt-strike_icedid_luca-stealer_njrat

.exe 403KB

2026-07-22_0d2486add8d55dbcf14e85b8b1dd9cbd_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH d30e08f85d0df8565fd129eddc7a3a9b
SHA256 9186bd0073440c45c9417ac7d2522c6e9abc7c3bab873347edb604c38f198529
MD5 0d2486add8d55dbcf14e85b8b1dd9cbd
SHA1 27d42208c624303a6f90eab0460ef000a4a00f8e
SHA512 5d475a3bee99deca0ac1c4a432651a8437201f8c794a95da8cee7e703211312daa69692a183a954e27aedb091b39e5959cf7e4781ed682bdbe8b76289bff7417
SSDEEP 6144:WKELA/njuvagzrUuIytV7f/kBRWqXk3jTPvZWsFo5:WKiUMag/UuIkRHTPBRFQ
TLSH
T1BE94AE56D3E525E5E8A38139C952C603E7B2BC560720DB9F12A076593F333D1AE3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

107440

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\KDU-1.4.9\Source\Hamakaze\output\x64\Release\kdu.pdb

kernel32

ReadFile WriteFile SetFilePointer TerminateProcess Sleep VirtualUnlock VirtualLock TerminateThread CreateThread HeapSetInformation SetDllDirectoryW GetStdHandle CreateFileW WriteConsoleW WideCharToMultiByte GetFileType VirtualFree CreateEventW GetProcessHeap GetConsoleScreenBufferInfo SetConsoleTextAttribute GetCommandLineW GetModuleFileNameW FormatMessageW GetSystemInfo VirtualAllocEx ReadProcessMemory GetSystemTimeAsFileTime VirtualFreeEx CreateFileMappingW MapViewOfFile GetFirmwareEnvironmentVariableW GetConsoleMode ExpandEnvironmentStringsW LoadLibraryW GetCurrentDirectoryW HeapFree HeapReAlloc GetModuleHandleW CreateProcessW DeleteFileW UnmapViewOfFile ResumeThread WriteProcessMemory GetStartupInfoW HeapDestroy HeapAlloc HeapCreate LoadLibraryExW FreeLibrary GetProcAddress GetSystemDirectoryW RtlCompareMemory CloseHandle WaitForSingleObject GetLastError GetCurrentProcess HeapSize GetFileSizeEx SetFilePointerEx GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetConsoleOutputCP FlushFileBuffers LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetCommandLineA GetModuleHandleExW ExitProcess RtlPcToFileHeader RaiseException EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId VirtualAlloc SetLastError

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW RegCreateKeyExW RegDeleteKeyW RegSetValueExW RegEnumKeyExW

crypt32

CertFindCertificateInStore CryptMsgUpdate CryptMsgClose CertCreateCertificateContext CryptMsgGetParam CertCloseStore CertGetNameStringW CertOpenStore CryptMsgOpenToDecode CertFreeCertificateContext

ntdll

LdrLockLoaderLock RtlTimeToSecondsSince1970 NtTerminateProcess NtWaitForSingleObject NtSetInformationProcess LdrUnlockLoaderLock NtOpenFile NtSetValueKey NtOpenSection NtQueryObject LdrFindEntryForAddress NtFsControlFile RtlLengthRequiredSid RtlEqualUnicodeString LdrGetProcedureAddress RtlNtdllName NtDuplicateObject NtCreateMutant RtlGetVersion LdrUnloadDll RtlAdjustPrivilege NtSetSecurityObject RtlDoesFileExists_U NtAlpcDisconnectPort RtlCreateSecurityDescriptor NtAlpcCreatePort RtlCreateAcl NtAlpcAcceptConnectPort RtlAddAccessAllowedAce RtlLengthSid NtReplyWaitReceivePort RtlSetDaclSecurityDescriptor RtlSubAuthoritySid NtDeviceIoControlFile NtLoadDriver NtUnloadDriver NtOpenKey NtMapViewOfSection NtUnmapViewOfSection LdrLoadDll NtCreateSection LdrAccessResource RtlSetLastWin32Error NtCreateFile RtlNtStatusToDosError RtlEqualSid RtlInitString RtlFreeHeap NtQueryDirectoryObject RtlFreeSid RtlExpandEnvironmentStrings NtOpenDirectoryObject NtFlushBuffersFile RtlUnicodeStringToAnsiString NtClose NtQueryInformationToken RtlAllocateAndInitializeSid LdrFindResource_U RtlDosPathNameToNtPathName_U RtlInitUnicodeString NtOpenProcess RtlFreeUnicodeString NtQueryInformationProcess NtWriteFile NtQuerySystemInformation RtlAllocateHeap NtOpenThread NtFreeVirtualMemory NtOpenProcessToken RtlAnsiStringToUnicodeString RtlFreeAnsiString NtAdjustPrivilegesToken RtlImageNtHeader RtlInitializeSid

rpcrt4

UuidCreate

setupapi

SetupDiDestroyDeviceInfoList SetupDiCreateDeviceInfoW SetupDiSetDeviceRegistryPropertyW SetupDiCallClassInstaller SetupDiGetINFClassW SetupDiCreateDeviceInfoList SetupDiRemoveDevice InstallHinfSectionW

newdev

UpdateDriverForPlugAndPlayDevicesW

bcrypt

BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptEncrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptGetProperty

fltlib

FilterConnectCommunicationPort FilterSendMessage

msdelta

DeltaFree ApplyDeltaB

Name

.text

Size

202KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_0d2486add8d55dbcf14e85b8b1dd9cbd_cobalt-strike_icedid_luca-stealer_njrat

kernel32

advapi32

crypt32

ntdll

rpcrt4

setupapi

newdev

bcrypt

fltlib

msdelta

generic