2026-09-04_5bf38604888e5445aef99afabe2e1031_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_5bf38604888e5445aef99afabe2e1031_cobalt-strike_icedid_luca-stealer_njrat
Size 347KB
Sample260905-lr59tsda97
SHA256 9bb3b6b1e98fcecd2026458c5ed81bd76cb0e2c4ca865437b6b5ed6df2244b50
MD5 5bf38604888e5445aef99afabe2e1031
SHA1 d367e6abd0a8597df6d660514fb46f6c34b270c4
SHA512 4b86577f1dd9c276fe335f31262270b9555ffd01501d783f51ac10bdc7ad6436d3b9473e6d98c8538d8af7d1d912b7bdf05471ede51fc6e42ba23f92417fbe75
SSDEEP 6144:NroI0s3/+YHvlqNN6ofJVYhulYpkm7OXBTs95I8Gu82sxDRBmn3PmGuvxTIFI7zq:TA6MJV6pkm7O5s95I8Gu82sxDRBmn3P/
TLSH
T15E746D059E23459EEA338438E256E403FAAFB8648315CBEF9F958920BD774C6DE31750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-04_5bf38604888e5445aef99afabe2e1031_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-09-04_5bf38604888e5445aef99afabe2e1031_cobalt-strike_icedid_luca-stealer_njrat

.exe 347KB

2026-09-04_5bf38604888e5445aef99afabe2e1031_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH ca64547c988e3dc94061e8525c2f6f42
SHA256 9bb3b6b1e98fcecd2026458c5ed81bd76cb0e2c4ca865437b6b5ed6df2244b50
MD5 5bf38604888e5445aef99afabe2e1031
SHA1 d367e6abd0a8597df6d660514fb46f6c34b270c4
SHA512 4b86577f1dd9c276fe335f31262270b9555ffd01501d783f51ac10bdc7ad6436d3b9473e6d98c8538d8af7d1d912b7bdf05471ede51fc6e42ba23f92417fbe75
SSDEEP 6144:NroI0s3/+YHvlqNN6ofJVYhulYpkm7OXBTs95I8Gu82sxDRBmn3PmGuvxTIFI7zq:TA6MJV6pkm7O5s95I8Gu82sxDRBmn3P/
TLSH
T15E746D059E23459EEA338438E256E403FAAFB8648315CBEF9F958920BD774C6DE31750
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

aa:22:b6:2c:b4:8a:23:87:56:88:b8:74:64:8c:fe:7c:2a:0a:9e:b4:4d:69:90:c1:f7:63:f2:bb:77:04:3b:61

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Redline Software LLC,O=Redline Software,C=US

Chains

Sep 4, 2026

CN=Redline Software LLC,O=Redline Software,C=US

Minor OS version

Major OS version

Entry point

85728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

DefWindowProcW PostMessageW UnregisterClassW GetDpiForSystem LoadCursorW GetCursorPos ReleaseDC GetDC GetForegroundWindow GetSystemMetrics DestroyWindow CreateWindowExW RegisterClassExW

winmm

timeGetTime

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW

gdi32

SelectObject GetDeviceCaps DeleteObject DeleteDC CreateCompatibleDC GetStockObject GetTextMetricsW

winspool.drv

EnumPrintersW

oleaut32

SysFreeString SysStringLen SysAllocString

comctl32

InitCommonControlsEx ImageList_Destroy ImageList_Create

kernel32

FlsFree InitializeCriticalSectionEx VirtualProtect FlsSetValue FlsGetValue FlsAlloc CloseHandle GetModuleHandleA GetProcAddress GetCurrentProcess LoadLibraryA ExitProcess GetCurrentProcessId GetLastError GetCommandLineW LocalFree QueryPerformanceCounter InitializeCriticalSection EnterCriticalSection LeaveCriticalSection VirtualQuery HeapAlloc GetConsoleMode GetProcessHeap GetTickCount GetModuleFileNameW GetCurrentThread SetThreadDescription GetModuleHandleW GetProfileIntW K32GetProcessMemoryInfo GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCommandLineA GetCPInfo GetOEMCP GetACP LCMapStringW SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetCurrentThreadId IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType WideCharToMultiByte GetModuleHandleExW WriteFile CreateFileW WriteConsoleW GetConsoleOutputCP HeapFree GetStdHandle EncodePointer LoadLibraryExW FreeLibrary TlsFree TlsSetValue ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue

ole32

CoCreateGuid CoTaskMemAlloc CoTaskMemFree CoUninitialize CoInitializeEx StringFromGUID2

shell32

SHGetFolderPathW CommandLineToArgvW

uxtheme

CloseThemeData OpenThemeData

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW

imm32

ImmReleaseContext ImmGetContext

shlwapi

PathIsDirectoryW

dwmapi

DwmGetColorizationColor

advapi32

RegCloseKey RegOpenKeyExW CryptReleaseContext CryptAcquireContextW RegQueryValueExW

version

GetFileVersionInfoSizeW

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlAllocateHeap RtlFreeHeap RtlVirtualUnwind

Name

.text

Size

156KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

61KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

114KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_5bf38604888e5445aef99afabe2e1031_cobalt-strike_icedid_luca-stealer_njrat

PE Signature issue

user32

winmm

wtsapi32

gdi32

winspool.drv

oleaut32

comctl32

kernel32

ole32

shell32

uxtheme

setupapi

imm32

shlwapi

dwmapi

advapi32

version

ntdll

generic