2026-09-07_df3bbb31887c4de15f750eeab7439de7_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-07_df3bbb31887c4de15f750eeab7439de7_cobalt-strike_icedid_luca-stealer_njrat
Size 742KB
Sample260908-eb4mqsch23
SHA256 e7d495aa1841a777a2f310817e01df94facb94db2df0654acb615d4c9ea6224d
MD5 df3bbb31887c4de15f750eeab7439de7
SHA1 523963ab1423f0f9bcc298f4cd2a1aeec22524c8
SHA512 c2a00578e804ca59307dc77f042f856dc08c6495c639b012d58df5a8e9194bfbf6361c05a67f93bdd39814f8f056e9cd9e3a89d2a07b2773e5a678d72c440639
SSDEEP 12288:loNBnHmI0nxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:eNX0nxD1vwakNwkqIivzksIBNyHq82
TLSH
T19DF402A7779524F9E0FA8278D9621901E3327C76072056BF07A852751E232D26E3FF61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-07_df3bbb31887c4de15f750eeab7439de7_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-09-07_df3bbb31887c4de15f750eeab7439de7_cobalt-strike_icedid_luca-stealer_njrat

.exe 742KB

2026-09-07_df3bbb31887c4de15f750eeab7439de7_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH f3e562e0f17069a6ebba681122479a74
SHA256 e7d495aa1841a777a2f310817e01df94facb94db2df0654acb615d4c9ea6224d
MD5 df3bbb31887c4de15f750eeab7439de7
SHA1 523963ab1423f0f9bcc298f4cd2a1aeec22524c8
SHA512 c2a00578e804ca59307dc77f042f856dc08c6495c639b012d58df5a8e9194bfbf6361c05a67f93bdd39814f8f056e9cd9e3a89d2a07b2773e5a678d72c440639
SSDEEP 12288:loNBnHmI0nxC21vwanrRpNXKNwkqrkiieg6xVEsIzp4Q7+ihRLyHQweG1Faxf:eNX0nxD1vwakNwkqIivzksIBNyHq82
TLSH
T19DF402A7779524F9E0FA8278D9621901E3327C76072056BF07A852751E232D26E3FF61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\etcher\etcher\node_modules\winusb-driver-generator\build\Release\installer_x86.pdb

kernel32

MultiByteToWideChar Sleep GetLastError CreateFileA SetEvent LoadLibraryA GetVersionExA GetModuleHandleA GetOverlappedResult GetProcAddress GetFileSize FreeLibrary WideCharToMultiByte FormatMessageA CreateEventA WriteConsoleW WaitForSingleObject SetFilePointer WriteFile GetFullPathNameW SetLastError CloseHandle ReadFile CreateFileW HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetProcessHeap RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW

advapi32

RegQueryValueExA RegCreateKeyExA RegSetValueExA ConvertStringSidToSidA RegDeleteValueA RegCloseKey

ole32

CoCreateInstance CoInitializeEx

newdev

UpdateDriverForPlugAndPlayDevicesW

setupapi

SetupDiGetDeviceRegistryPropertyA SetupDiEnumDeviceInfo SetupDiGetClassDevsA SetupDiSetDeviceRegistryPropertyA SetupCopyOEMInfW

Name

.text

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

587KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-07_df3bbb31887c4de15f750eeab7439de7_cobalt-strike_icedid_luca-stealer_njrat

kernel32

advapi32

ole32

newdev

setupapi

generic