2026-08-10_f051558ae0cf78086bd42313ff6deda5_cobalt-strike_icedid_luca-stealer_njrat

General

Target
2026-08-10_f051558ae0cf78086bd42313ff6deda5_cobalt-strike_icedid_luca-stealer_njrat
Size 164KB
Sample260810-vj7mcsdn2y
SHA256 09b2b6fc3d64477d42986685593edc981d066e7a9a6440d34708c8a4f2a6f7d4
MD5 f051558ae0cf78086bd42313ff6deda5
SHA1 d286f5c3910ff1611edf4f874b36bacff8dcfd10
SHA512 0a19d5be5d492c856c02f9c0f196bb1b4beedaf63fdf3c2cb180144729f8b17951eca19b5412fb87de3023de1066f72be79bcdacffeac13520bad565e0611b23
SSDEEP 3072:PXigaAQUnIWO50G1qrEmDjOSqdKIXVFdhfCpAiqxfdXuP/f41:dzEyudVhfCaiq2Pn4
TLSH
T1D5F35B66BAA958F6E0B79135885219B2E7327C3547109BEF0390C3775F235F8AD3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_f051558ae0cf78086bd42313ff6deda5_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-08-10_f051558ae0cf78086bd42313ff6deda5_cobalt-strike_icedid_luca-stealer_njrat

.exe 164KB

2026-08-10_f051558ae0cf78086bd42313ff6deda5_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH d51d838a40c18422a8dae1b08ef3dda0
SHA256 09b2b6fc3d64477d42986685593edc981d066e7a9a6440d34708c8a4f2a6f7d4
MD5 f051558ae0cf78086bd42313ff6deda5
SHA1 d286f5c3910ff1611edf4f874b36bacff8dcfd10
SHA512 0a19d5be5d492c856c02f9c0f196bb1b4beedaf63fdf3c2cb180144729f8b17951eca19b5412fb87de3023de1066f72be79bcdacffeac13520bad565e0611b23
SSDEEP 3072:PXigaAQUnIWO50G1qrEmDjOSqdKIXVFdhfCpAiqxfdXuP/f41:dzEyudVhfCaiq2Pn4
TLSH
T1D5F35B66BAA958F6E0B79135885219B2E7327C3547109BEF0390C3775F235F8AD3A720
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

22856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleHandleA GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW WriteConsoleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetCommandLineA GetCommandLineW ReadFile GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree CloseHandle GetConsoleMode ReadConsoleW SetFilePointerEx GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap FlushFileBuffers GetConsoleOutputCP CreateFileW HeapSize HeapReAlloc SetEndOfFile

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-10_f051558ae0cf78086bd42313ff6deda5_cobalt-strike_icedid_luca-stealer_njrat

kernel32

generic