2026-08-08_b9c25fcbf528cee79b14890bbfd24764_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-08-08_b9c25fcbf528cee79b14890bbfd24764_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 221KB
Sample260808-knyvxack91
SHA256 c2abed9d7afc472cdbbd4b45a770669cea4a9049e567d1de22408700a3ceefdb
MD5 b9c25fcbf528cee79b14890bbfd24764
SHA1 d504081774e618ed63593ed35a405ac82f1f4ad2
SHA512 1f8d81018a26ce33713786a783373e5c7a832e2dbb8b1bd87012db6ccacb0ff8e3951c8e2626762e369d7414fcec7e40e6837159e5625714b0c5cd107b178377
SSDEEP 3072:vM1sgBzBrcYGpCmKtRBgd7nYRMYqcHQlGn6h/07cVdNr0Yqwa:vM1swzBrh7RBgBYLHWnXT+
TLSH
T181246A15B3E144F9D5B39235C9A04906EB76BC460760EBAB07E042A7AF237E16D3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-08-08_b9c25fcbf528cee79b14890bbfd24764_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-08_b9c25fcbf528cee79b14890bbfd24764_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 221KB

2026-08-08_b9c25fcbf528cee79b14890bbfd24764_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 184bd123d9788cc46757ba661b41e02d
SHA256 c2abed9d7afc472cdbbd4b45a770669cea4a9049e567d1de22408700a3ceefdb
MD5 b9c25fcbf528cee79b14890bbfd24764
SHA1 d504081774e618ed63593ed35a405ac82f1f4ad2
SHA512 1f8d81018a26ce33713786a783373e5c7a832e2dbb8b1bd87012db6ccacb0ff8e3951c8e2626762e369d7414fcec7e40e6837159e5625714b0c5cd107b178377
SSDEEP 3072:vM1sgBzBrcYGpCmKtRBgd7nYRMYqcHQlGn6h/07cVdNr0Yqwa:vM1swzBrh7RBgBYLHWnXT+
TLSH
T181246A15B3E144F9D5B39235C9A04906EB76BC460760EBAB07E042A7AF237E16D3FB11
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

e6:8b:25:5e:43:d7:e9:2c:7c:15:59:cb:f0:9b:b7:67:46:4c:17:da:fd:79:eb:9c:d2:a0:9f:28:06:6a:c8:d3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=SecureCrypt Labs

Chains

Aug 1, 2026

CN=SecureCrypt Labs

Subject

CN=SecureCrypt Labs

Serial Number

1b:13:cc:b4:be:ad:e1:a0:46:2a:66:df:9d:76:a5:87

Issuer

CN=SecureCrypt Labs

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 31, 2026 - Jul 31, 2031

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

38108

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptDestroyKey BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData BCryptImportKeyPair BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptOpenAlgorithmProvider BCryptDecrypt BCryptDeriveKeyPBKDF2

user32

MessageBoxA

shell32

ShellExecuteExW

kernel32

EncodePointer HeapSize SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage CreateDirectoryW ReadFile GetFileSizeEx WriteFile RemoveDirectoryW GetModuleFileNameW GetTempPathW GetEnvironmentVariableA WaitForSingleObject CreateFileW MultiByteToWideChar Sleep DeleteFileW CloseHandle MoveFileExW GetCurrentProcessId CreateProcessW WideCharToMultiByte GetTickCount IsDebuggerPresent GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetModuleHandleW FindNextFileW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle GetFileType GetModuleHandleExW WriteConsoleW ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW HeapReAlloc OutputDebugStringW FindClose FindFirstFileExW

Name

.text

Size

140KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_b9c25fcbf528cee79b14890bbfd24764_cobalt-strike_icedid_luca-stealer_njrat_stealc

PE Signature issue

bcrypt

user32

shell32

kernel32

generic