2026-09-04_76781841032a34354d8fa155b323b6b3_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_76781841032a34354d8fa155b323b6b3_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk
Size 354KB
Sample260905-ham55syclf
SHA256 714b2c419d8489485040f9902149d4fa002bd2f957df4b04ba20cd5ee0c104ec
MD5 76781841032a34354d8fa155b323b6b3
SHA1 cb9140a82ceac2a81690aa736277f44deaa0f2d7
SHA512 8118ad45ec4dcf8d31b6d8720179f13a8bc740b22f190072f37660a60fd068a60e20aca0f9782a7fcc6d9d78716a926d3eaebddf6821491609ebb5f136751e7f
SSDEEP 6144:+7OfLsXgeyLVKi5qGEZaVp8pthDENYW6xKyOr49BQSAXhDepDIeGcfGKuZrURZdX:n1cthQYW6cyOM9BQSAXhDep1GcfGKuZ6
TLSH
T1E6746C059A17549FDD33C038D35BA943F9AF78148318E7EB8F9682243DA76C69E31B60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-04_76781841032a34354d8fa155b323b6b3_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk

File Explorer

2026-09-04_76781841032a34354d8fa155b323b6b3_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk

.exe 354KB

2026-09-04_76781841032a34354d8fa155b323b6b3_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk

IMPHASH b18db320f027628d84281e1882b516af
SHA256 714b2c419d8489485040f9902149d4fa002bd2f957df4b04ba20cd5ee0c104ec
MD5 76781841032a34354d8fa155b323b6b3
SHA1 cb9140a82ceac2a81690aa736277f44deaa0f2d7
SHA512 8118ad45ec4dcf8d31b6d8720179f13a8bc740b22f190072f37660a60fd068a60e20aca0f9782a7fcc6d9d78716a926d3eaebddf6821491609ebb5f136751e7f
SSDEEP 6144:+7OfLsXgeyLVKi5qGEZaVp8pthDENYW6xKyOr49BQSAXhDepDIeGcfGKuZrURZdX:n1cthQYW6cyOM9BQSAXhDep1GcfGKuZ6
TLSH
T1E6746C059A17549FDD33C038D35BA943F9AF78148318E7EB8F9682243DA76C69E31B60
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

7d:ce:3e:55:12:8a:57:e4:61:1a:55:3a:7b:88:b2:57:cd:c7:aa:f0:4d:9b:46:11:69:b9:b5:ce:ab:1b:d1:d8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Redline Software LLC,O=Redline Software,C=US

Chains

Sep 4, 2026

CN=Redline Software LLC,O=Redline Software,C=US

Minor OS version

Major OS version

Entry point

102824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shlwapi

PathIsDirectoryW

dwmapi

DwmGetColorizationColor

ntdll

RtlAllocateHeap RtlFreeHeap

version

GetFileVersionInfoSizeW

ole32

CoCreateGuid CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize StringFromGUID2

gdi32

CreateCompatibleDC DeleteDC DeleteObject GetDeviceCaps GetStockObject GetTextMetricsW SelectObject

comctl32

ImageList_Create ImageList_Destroy InitCommonControlsEx

advapi32

CryptAcquireContextW CryptReleaseContext RegCloseKey RegOpenKeyExW RegQueryValueExW

user32

CreateWindowExW DefWindowProcW DestroyWindow GetCursorPos GetDC GetDpiForSystem GetForegroundWindow GetSystemMetrics LoadCursorW PostMessageW RegisterClassExW ReleaseDC UnregisterClassW

oleaut32

SysAllocString SysFreeString SysStringLen

uxtheme

CloseThemeData OpenThemeData

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

imm32

ImmGetContext ImmReleaseContext

winmm

timeGetTime

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetFileType GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProfileIntW GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage K32GetProcessMemoryInfo LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree MultiByteToWideChar QueryPerformanceCounter RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFilePointerEx SetLastError SetThreadDescription SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

shell32

CommandLineToArgvW SHGetFolderPathW

winspool.drv

EnumPrintersW

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW

Name

.text

Size

174KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

116KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_76781841032a34354d8fa155b323b6b3_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk

PE Signature issue

shlwapi

dwmapi

ntdll

version

ole32

gdi32

comctl32

advapi32

user32

oleaut32

uxtheme

wtsapi32

imm32

winmm

kernel32

shell32

winspool.drv

setupapi

generic