2026-08-08_f1a0d3a83b167732211fe52e8fee362c_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_f1a0d3a83b167732211fe52e8fee362c_cobalt-strike_icedid_luca-stealer_njrat
Size 195KB
Sample260808-cv98hsfr7x
SHA256 e2ef07531513c6fd6eccc894f396739d8943624d1bb562191d2917d521d361ae
MD5 f1a0d3a83b167732211fe52e8fee362c
SHA1 f84d59080115c02ebbe51362070f40e9d1d18206
SHA512 3f6110adf5ebe03000715dd6d0eb0ebaa5a08d011c5b966a8f84f15b6878f5eacfcce7b9e032311ad49251ebc4168789cf59cee0a03b8d143b584222181262c0
SSDEEP 3072:YTEfxQni2tcuyyrGCOd2Ly7uS1nhYtPrdsCNGf/21t/lK:K9d5lXuOzdsCNkkt
TLSH
T1A4145A5AB7A200F9E4B7D238C9525616F673781503209BEB43A04B769F237E0BD3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_f1a0d3a83b167732211fe52e8fee362c_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-08-08_f1a0d3a83b167732211fe52e8fee362c_cobalt-strike_icedid_luca-stealer_njrat

.exe 195KB

2026-08-08_f1a0d3a83b167732211fe52e8fee362c_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 2063e26047fbf5533955ef7823f4e7a7
SHA256 e2ef07531513c6fd6eccc894f396739d8943624d1bb562191d2917d521d361ae
MD5 f1a0d3a83b167732211fe52e8fee362c
SHA1 f84d59080115c02ebbe51362070f40e9d1d18206
SHA512 3f6110adf5ebe03000715dd6d0eb0ebaa5a08d011c5b966a8f84f15b6878f5eacfcce7b9e032311ad49251ebc4168789cf59cee0a03b8d143b584222181262c0
SSDEEP 3072:YTEfxQni2tcuyyrGCOd2Ly7uS1nhYtPrdsCNGf/21t/lK:K9d5lXuOzdsCNkkt
TLSH
T1A4145A5AB7A200F9E4B7D238C9525616F673781503209BEB43A04B769F237E0BD3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

ShellExecuteExA SHGetFolderPathA

ws2_32

htons connect recv send closesocket setsockopt socket WSAStartup WSAGetLastError select WSAIoctl inet_pton

user32

ShowWindow GetSystemMetrics GetDC wsprintfA ReleaseDC

advapi32

IsValidSid AdjustTokenPrivileges OpenProcessToken LsaQueryInformationPolicy LsaOpenPolicy LsaClose LsaFreeMemory CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA RegSetValueExA RegOpenKeyExA RegCloseKey GetUserNameA LookupPrivilegeValueA GetSidSubAuthority GetTokenInformation GetSidSubAuthorityCount GetSidIdentifierAuthority

urlmon

URLDownloadToFileA

gdi32

DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt SelectObject

crypt32

CryptUnprotectData

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts

ole32

CoInitializeEx CoCreateInstance CoUninitialize

bcrypt

BCryptSetProperty BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider

kernel32

GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap CreateFileW WideCharToMultiByte ReadConsoleW GetFileSizeEx HeapSize HeapReAlloc SetEndOfFile FindClose GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW SetFilePointerEx FindFirstFileExW WriteConsoleW TerminateProcess GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType LCMapStringW CompareStringW InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc SearchPathA CreateDirectoryA CreateFileA DeleteFileA GetFileAttributesA GetFileSize ReadFile SetFileAttributesA WriteFile GetTempPathA GetVolumeInformationA CloseHandle SetHandleInformation SetUnhandledExceptionFilter GetLastError CreatePipe PeekNamedPipe WaitForSingleObject CreateMutexA Sleep GetCurrentProcess GetCurrentProcessId ExitProcess RtlUnwind GetExitCodeProcess CreateThread CreateProcessA SetPriorityClass GetLocalTime GetTickCount VirtualProtect GetModuleFileNameA GetModuleHandleA GetProcAddress LocalFree OpenMutexA CopyFileA GetComputerNameA MultiByteToWideChar AllocConsole SetConsoleCtrlHandler GetConsoleWindow RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW HeapFree RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW GetModuleHandleExW GetCommandLineA GetCommandLineW

Name

.text

Size

127KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

53KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_f1a0d3a83b167732211fe52e8fee362c_cobalt-strike_icedid_luca-stealer_njrat

shell32

ws2_32

user32

advapi32

urlmon

gdi32

crypt32

winhttp

ole32

bcrypt

kernel32

generic