2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat

General

Target
2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat
Size 293KB
Sample260828-e1g52aep9z
SHA256 dec6ad0dbe906620edb61d5d2eaf90e2d851e91ad3510050419c386ee4b0d939
MD5 de83a50e1af985354eb1294abdcb7eba
SHA1 55e82a4cfd9fde5ea81d8186f3343829b413fc91
SHA512 b663c0028526f98af458a7d1a371b1e89c2af593a27ef19aa683d87921e2c123588c14c11620e20262b96a6db2a66af6aa86c7407afd1db1cd2f0935c76a22f6
SSDEEP 3072:G6J95zEieTNPkSSaJiCfqKeNF87+X5XI2Hmfr49WFk4buAs0FNmhMn+IhNn/gS68:vtvEcSSpJKGFdXOsW+1YlR
TLSH
T1D0544A06B79A01E5D0B68174877747E2AB3D7C214791C68F07D47B66EE3E2C0BD2A722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat

.exe 293KB

2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 8e1f5f9dc38dc907a2d665b0610f54bb
SHA256 dec6ad0dbe906620edb61d5d2eaf90e2d851e91ad3510050419c386ee4b0d939
MD5 de83a50e1af985354eb1294abdcb7eba
SHA1 55e82a4cfd9fde5ea81d8186f3343829b413fc91
SHA512 b663c0028526f98af458a7d1a371b1e89c2af593a27ef19aa683d87921e2c123588c14c11620e20262b96a6db2a66af6aa86c7407afd1db1cd2f0935c76a22f6
SSDEEP 3072:G6J95zEieTNPkSSaJiCfqKeNF87+X5XI2Hmfr49WFk4buAs0FNmhMn+IhNn/gS68:vtvEcSSpJKGFdXOsW+1YlR
TLSH
T1D0544A06B79A01E5D0B68174877747E2AB3D7C214791C68F07D47B66EE3E2C0BD2A722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

391168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

WriteConsoleW SetEndOfFile TlsSetValue HeapReAlloc GetStartupInfoW SetConsoleCtrlHandler SetInformationJobObject QueryInformationJobObject CompareStringW GetCommandLineW GetCurrentProcess GetStdHandle AssignProcessToJobObject GetModuleFileNameW SetEnvironmentVariableW GetEnvironmentVariableW GetFileAttributesW DuplicateHandle MultiByteToWideChar FormatMessageW GetLastError WaitForSingleObjectEx CloseHandle CreateJobObjectA CreateProcessW GetExitCodeProcess HeapSize RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW WriteFile GetCommandLineA HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetStringTypeW ReadFile ReadConsoleW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetProcessHeap GetFileSizeEx SetFilePointerEx CreateFileW

Name

.text

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

39KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-27_de83a50e1af985354eb1294abdcb7eba_cobalt-strike_icedid_luca-stealer_njrat

version

kernel32

generic