2026-08-30_0ad7e440c1d1598841ac8f64d27d35eb_cobalt-strike_icedid_luca-stealer_njrat_ryuk

General

Target
2026-08-30_0ad7e440c1d1598841ac8f64d27d35eb_cobalt-strike_icedid_luca-stealer_njrat_ryuk
Size 161KB
Sample260830-1xtkjsan2z
SHA256 1d3004e3c0f60c376542d407bb58c16aa37862a2cda1be2dc0128fc735e62a07
MD5 0ad7e440c1d1598841ac8f64d27d35eb
SHA1 bc997f6c34e9b3a8f8f7e015848f4d7d2ad66d5c
SHA512 7e87cb8581deafd891d8ed625e1b952b1b22ead4b3f4464400a288c7ef2ed50e40412c8c1478aa7b7d6624da286405de603802cb87e68d28ae34c0dc0f42527b
SSDEEP 3072:AeMe+i0k6XqYs9di9Lm0ulFcQe/jLAU3zTGGA03:ADe+X7sSccQe7LACzD3
TLSH
T1E9F36C54B3E501F9E177C239C9624A06FA7278124760AADF03A44776EF633D09E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-30_0ad7e440c1d1598841ac8f64d27d35eb_cobalt-strike_icedid_luca-stealer_njrat_ryuk

File Explorer

2026-08-30_0ad7e440c1d1598841ac8f64d27d35eb_cobalt-strike_icedid_luca-stealer_njrat_ryuk

.exe 161KB

2026-08-30_0ad7e440c1d1598841ac8f64d27d35eb_cobalt-strike_icedid_luca-stealer_njrat_ryuk

IMPHASH 3b6ac3709d0aef4471a4b05fc8b72b52
SHA256 1d3004e3c0f60c376542d407bb58c16aa37862a2cda1be2dc0128fc735e62a07
MD5 0ad7e440c1d1598841ac8f64d27d35eb
SHA1 bc997f6c34e9b3a8f8f7e015848f4d7d2ad66d5c
SHA512 7e87cb8581deafd891d8ed625e1b952b1b22ead4b3f4464400a288c7ef2ed50e40412c8c1478aa7b7d6624da286405de603802cb87e68d28ae34c0dc0f42527b
SSDEEP 3072:AeMe+i0k6XqYs9di9Lm0ulFcQe/jLAU3zTGGA03:ADe+X7sSccQe7LACzD3
TLSH
T1E9F36C54B3E501F9E177C239C9624A06FA7278124760AADF03A44776EF633D09E3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CloseServiceHandle ControlService CreateServiceA DeleteService OpenSCManagerA OpenServiceA QueryServiceStatus StartServiceA

kernel32

CloseHandle CompareStringW CreateFileW CreateRemoteThread CreateToolhelp32Snapshot DeleteCriticalSection DeviceIoControl EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetExitCodeThread GetFileAttributesA GetFileSizeEx GetFileType GetFullPathNameA GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleTextAttribute SetConsoleTitleA SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAllocEx VirtualFreeEx VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

Name

.text

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-30_0ad7e440c1d1598841ac8f64d27d35eb_cobalt-strike_icedid_luca-stealer_njrat_ryuk

advapi32

kernel32

generic