2026-09-05_99227464a5c1877c970bd4778971c9df_cobalt-strike_icedid_luca-stealer_njrat

General

Target
2026-09-05_99227464a5c1877c970bd4778971c9df_cobalt-strike_icedid_luca-stealer_njrat
Size 156KB
Sample260907-nfbbestsdy
SHA256 3d63cc4f91d7ce1168181561a6a14cd1dee538a63ec196775bc7d55aeb89639d
MD5 99227464a5c1877c970bd4778971c9df
SHA1 758787c7971d0e3cb4d884ec4d123398bba9fabb
SHA512 139dd4554fd5f98579603e867aa1899dfd58cd8090272088611ed6de8c98aef17f663830dfaccc3e71845b929ff3605062addf40d5892267033231eca49cfebf
SSDEEP 3072:Yxx6HnkLZDxsUVyuMkggetzytJdnRF6aaPM73U:q6HoDx0kggyB07
TLSH
T155F35B5773E621FAE0B79274C9A64646F772783107209BEF07A446762F232D09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-05_99227464a5c1877c970bd4778971c9df_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-09-05_99227464a5c1877c970bd4778971c9df_cobalt-strike_icedid_luca-stealer_njrat

.exe 156KB

2026-09-05_99227464a5c1877c970bd4778971c9df_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH e6057737e65b7f24785734fb3a554ee3
SHA256 3d63cc4f91d7ce1168181561a6a14cd1dee538a63ec196775bc7d55aeb89639d
MD5 99227464a5c1877c970bd4778971c9df
SHA1 758787c7971d0e3cb4d884ec4d123398bba9fabb
SHA512 139dd4554fd5f98579603e867aa1899dfd58cd8090272088611ed6de8c98aef17f663830dfaccc3e71845b929ff3605062addf40d5892267033231eca49cfebf
SSDEEP 3072:Yxx6HnkLZDxsUVyuMkggetzytJdnRF6aaPM73U:q6HoDx0kggyB07
TLSH
T155F35B5773E621FAE0B79274C9A64646F772783107209BEF07A446762F232D09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

12824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW GetUserNameW

shell32

CommandLineToArgvW

kernel32

WriteConsoleW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW SearchPathW CreateDirectoryW CreateFileW DeleteFileW FlushFileBuffers GetFileAttributesW GetFullPathNameW WriteFile CloseHandle GetLastError ReleaseMutex WaitForSingleObject CreateMutexW GetCurrentProcess GetCurrentProcessId GetExitCodeProcess CreateProcessW GetStartupInfoW OpenProcess GetSystemTime GetSystemTimeAsFileTime ReadProcessMemory GetModuleFileNameW GetModuleHandleW GetProcAddress LocalFree lstrcpynW QueryFullProcessImageNameW GetComputerNameW WideCharToMultiByte AttachConsole GetConsoleWindow RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId InitializeSListHead IsDebuggerPresent RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle ExitProcess GetModuleHandleExW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW GetProcessHeap GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc

Name

.text

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-05_99227464a5c1877c970bd4778971c9df_cobalt-strike_icedid_luca-stealer_njrat

advapi32

shell32

kernel32

generic