2026-09-04_4160a5ab259be9af76be833a96c97ab3_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-04_4160a5ab259be9af76be833a96c97ab3_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk
Size 385KB
Sample260905-p9twasea39
SHA256 b72d1e59408ee57eb3334b0435318e59137a7069e439b029134ce6e65e6d351a
MD5 4160a5ab259be9af76be833a96c97ab3
SHA1 7ddb1209fff78e991341d89b775342a8a56c1374
SHA512 ee1ef799ba6379f4249499608d2ee9a91f373af600a682c981cd84d6e955e76e97670f5f82d8b38dadcb55a715be51eb44a0f5d350877a1ae256eb77af4c9ce7
SSDEEP 12288:OnYgpNSbxTkqwm5i/Xub0vHQPPYDjg3plF/HdfHGGYSvSU2WjR7YY42hl1itFdYP:OnRpEwm5i/Xub0vHQPPYDk3pH/HdfHGW
TLSH
T158845C05CA5354DFD973C038D29BA803F9ABB8558318E7EB4F568A243D676C68F31B60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-04_4160a5ab259be9af76be833a96c97ab3_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk

File Explorer

2026-09-04_4160a5ab259be9af76be833a96c97ab3_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk

.exe 385KB

2026-09-04_4160a5ab259be9af76be833a96c97ab3_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk

IMPHASH 8e5f8116b90c089bdaaaddf6154e7923
SHA256 b72d1e59408ee57eb3334b0435318e59137a7069e439b029134ce6e65e6d351a
MD5 4160a5ab259be9af76be833a96c97ab3
SHA1 7ddb1209fff78e991341d89b775342a8a56c1374
SHA512 ee1ef799ba6379f4249499608d2ee9a91f373af600a682c981cd84d6e955e76e97670f5f82d8b38dadcb55a715be51eb44a0f5d350877a1ae256eb77af4c9ce7
SSDEEP 12288:OnYgpNSbxTkqwm5i/Xub0vHQPPYDjg3plF/HdfHGGYSvSU2WjR7YY42hl1itFdYP:OnRpEwm5i/Xub0vHQPPYDk3pH/HdfHGW
TLSH
T158845C05CA5354DFD973C038D29BA803F9ABB8558318E7EB4F568A243D676C68F31B60
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

be:b3:61:d3:88:f6:7d:47:5b:bf:87:a0:49:04:41:d7:ae:35:39:94:80:11:ed:05:85:38:81:e7:3b:e5:d5:f0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Redline Software LLC,O=Redline Software,C=US

Chains

Sep 4, 2026

CN=Redline Software LLC,O=Redline Software,C=US

Minor OS version

Major OS version

Entry point

113348

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

ImageList_Create ImageList_Destroy InitCommonControlsEx

version

GetFileVersionInfoSizeW

shlwapi

PathIsDirectoryW

winmm

timeGetTime

uxtheme

CloseThemeData OpenThemeData

dwmapi

DwmGetColorizationColor

oleaut32

SysAllocString SysFreeString SysStringLen

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

winspool.drv

EnumPrintersW

imm32

ImmGetContext ImmReleaseContext

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW

kernel32

AcquireSRWLockExclusive CloseHandle CreateDirectoryW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileSizeEx GetFileType GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProfileIntW GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage K32EnumProcessModules K32GetModuleFileNameExW K32GetProcessMemoryInfo LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree MultiByteToWideChar QueryPerformanceCounter RaiseException ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFilePointerEx SetLastError SetThreadDescription SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

user32

CreateWindowExW DefWindowProcW DestroyWindow GetCursorPos GetDC GetDpiForSystem GetForegroundWindow GetSystemMetrics LoadCursorW PostMessageW RegisterClassExW ReleaseDC UnregisterClassW

gdi32

CreateCompatibleDC DeleteDC DeleteObject GetDeviceCaps GetStockObject GetTextMetricsW SelectObject

shell32

CommandLineToArgvW SHGetFolderPathW

ole32

CoCreateGuid CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize StringFromGUID2

advapi32

CryptAcquireContextW CryptReleaseContext RegCloseKey RegOpenKeyExW RegQueryValueExW

ntdll

RtlAllocateHeap RtlFreeHeap

Name

.text

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

117KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-04_4160a5ab259be9af76be833a96c97ab3_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk

PE Signature issue

comctl32

version

shlwapi

winmm

uxtheme

dwmapi

oleaut32

wtsapi32

winspool.drv

imm32

setupapi

kernel32

user32

gdi32

shell32

ole32

advapi32

ntdll

generic