2026-08-10_6769c53bfc878b3f472dc492dfd87f7f_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_6769c53bfc878b3f472dc492dfd87f7f_cobalt-strike_icedid_luca-stealer_njrat
Size 225KB
Sample260810-sqcdpaxtdv
SHA256 20a8fad9590cd227f64de8b05b47c3a52c1e2ebbf375df7d8da88a4c8763d0a9
MD5 6769c53bfc878b3f472dc492dfd87f7f
SHA1 0d150355bb96db71617799d14dbc91512a9781a6
SHA512 2776932431701d269082a95c7ddf577768c0f76d05458b2fd8c585974ef3648cf651d5aeb4309e6e5e4df1bb963a20cbd3ad4f3e8c548959f317280b22937a1a
SSDEEP 3072:v5H99IQaLrWhxwD5ZOyz3TKWbl36TtS62QrP1++uk+OPS7xNgdKUidcOwqb7oGCM:K74Cme3zRGdzuk+OUxYElYHP
TLSH
T1E5349E49B7A608F9E8B3C139C8521A16F7B27C510760DBDF03A0465ADF236E1AD3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_6769c53bfc878b3f472dc492dfd87f7f_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-08-10_6769c53bfc878b3f472dc492dfd87f7f_cobalt-strike_icedid_luca-stealer_njrat

.exe 225KB

2026-08-10_6769c53bfc878b3f472dc492dfd87f7f_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH d77f8ed41a937b2219fd7c3bab4f56f2
SHA256 20a8fad9590cd227f64de8b05b47c3a52c1e2ebbf375df7d8da88a4c8763d0a9
MD5 6769c53bfc878b3f472dc492dfd87f7f
SHA1 0d150355bb96db71617799d14dbc91512a9781a6
SHA512 2776932431701d269082a95c7ddf577768c0f76d05458b2fd8c585974ef3648cf651d5aeb4309e6e5e4df1bb963a20cbd3ad4f3e8c548959f317280b22937a1a
SSDEEP 3072:v5H99IQaLrWhxwD5ZOyz3TKWbl36TtS62QrP1++uk+OPS7xNgdKUidcOwqb7oGCM:K74Cme3zRGdzuk+OUxYElYHP
TLSH
T1E5349E49B7A608F9E8B3C139C8521A16F7B27C510760DBDF03A0465ADF236E1AD3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership FreeSid OpenProcessToken AdjustTokenPrivileges DuplicateTokenEx ImpersonateLoggedOnUser RevertToSelf LookupPrivilegeValueA RegCloseKey RegCreateKeyExA RegDeleteValueA RegOpenKeyExA RegSetValueExA ChangeServiceConfigA CloseServiceHandle ControlService CreateServiceA DeleteService OpenSCManagerA OpenServiceA QueryServiceStatus StartServiceA

shell32

ShellExecuteExA

ole32

CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

VariantInit SysAllocString SysFreeString

kernel32

WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx LCMapStringW CompareStringW GetCommandLineA CreateFileA CloseHandle GetLastError HeapAlloc HeapFree GetProcessHeap InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject CreateMutexA Sleep GetProcessTimes GetCurrentProcessId ExitProcess GetExitCodeProcess CreateThread CreateProcessA InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute OpenProcess VirtualAlloc VirtualProtect VirtualFree GetModuleFileNameA MultiByteToWideChar CreateFileW DeleteFileA WriteFile GetTempPathA QueryPerformanceCounter DeviceIoControl GetCurrentProcess GetTickCount GetSystemDirectoryA GetModuleHandleA GetProcAddress MoveFileExA WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW LocalFree InitializeCriticalSectionEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetModuleFileNameW GetModuleHandleExW GetCommandLineW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree

Name

.text

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_6769c53bfc878b3f472dc492dfd87f7f_cobalt-strike_icedid_luca-stealer_njrat

advapi32

shell32

ole32

oleaut32

kernel32

generic