2026-09-08_9816ef8beb5878654af944bcd175aa65_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-08_9816ef8beb5878654af944bcd175aa65_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk
Size 385KB
Sample260908-rkr2hssbmd
SHA256 aa3a9cd82119b25b36606449598b1cb800bf814471c117aa1103c60514ea1851
MD5 9816ef8beb5878654af944bcd175aa65
SHA1 920e76f76590fe71b4fa6d2261133234d627cbe4
SHA512 ad5262568d7c0c75062912fbec9f76f799d3dfbc0e7097da0ead2fd50105f4b2f4ba377a9949c093404bfb882758828451ee58d0daffd1e9fdd15b020b950449
SSDEEP 12288:/nYgpNSbxTkP9id+l7WqFSvLMFB0U+U3BwNkZBEQtHqfWMn+UKjelBM2EocUeHyB:/nRpF9id+l7WqFSvLMFB0U+U3BwNkZB4
TLSH
T13D845C05CA53549FE933C038D35BA803F9ABB8648718E7EB4F558A243D676C68F31B61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
2026-09-08_9816ef8beb5878654af944bcd175aa65_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk

File Explorer

2026-09-08_9816ef8beb5878654af944bcd175aa65_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk

.exe 385KB

2026-09-08_9816ef8beb5878654af944bcd175aa65_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk

IMPHASH 56bf0ec3f9fd9fa24fa3dbd31737bff7
SHA256 aa3a9cd82119b25b36606449598b1cb800bf814471c117aa1103c60514ea1851
MD5 9816ef8beb5878654af944bcd175aa65
SHA1 920e76f76590fe71b4fa6d2261133234d627cbe4
SHA512 ad5262568d7c0c75062912fbec9f76f799d3dfbc0e7097da0ead2fd50105f4b2f4ba377a9949c093404bfb882758828451ee58d0daffd1e9fdd15b020b950449
SSDEEP 12288:/nYgpNSbxTkP9id+l7WqFSvLMFB0U+U3BwNkZBEQtHqfWMn+UKjelBM2EocUeHyB:/nRpF9id+l7WqFSvLMFB0U+U3BwNkZB4
TLSH
T13D845C05CA53549FE933C038D35BA803F9ABB8648718E7EB4F558A243D676C68F31B61
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f6:f9:22:cc:6c:36:de:20:d8:62:de:7c:e6:4d:fe:4d:09:42:4f:73:b1:a4:d3:56:c5:dc:b8:29:7b:17:6e:10

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Redline Software LLC,O=Redline Software,C=US

Chains

Sep 4, 2026

CN=Redline Software LLC,O=Redline Software,C=US

Minor OS version

Major OS version

Entry point

113348

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

version

GetFileVersionInfoSizeW

imm32

ImmGetContext ImmReleaseContext

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory

dwmapi

DwmGetColorizationColor

advapi32

CryptAcquireContextW CryptReleaseContext RegCloseKey RegOpenKeyExW RegQueryValueExW

ntdll

RtlAllocateHeap RtlFreeHeap

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsW

comctl32

ImageList_Create ImageList_Destroy InitCommonControlsEx

oleaut32

SysAllocString SysFreeString SysStringLen

ole32

CoCreateGuid CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize StringFromGUID2

shlwapi

PathIsDirectoryW

kernel32

AcquireSRWLockExclusive CloseHandle CreateDirectoryW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileSizeEx GetFileType GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetProfileIntW GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage K32EnumProcessModules K32GetModuleFileNameExW K32GetProcessMemoryInfo LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree MultiByteToWideChar QueryPerformanceCounter RaiseException ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFilePointerEx SetLastError SetThreadDescription SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

winmm

timeGetTime

user32

CreateWindowExW DefWindowProcW DestroyWindow GetCursorPos GetDC GetDpiForSystem GetForegroundWindow GetSystemMetrics LoadCursorW PostMessageW RegisterClassExW ReleaseDC UnregisterClassW

shell32

CommandLineToArgvW SHGetFolderPathW

gdi32

CreateCompatibleDC DeleteDC DeleteObject GetDeviceCaps GetStockObject GetTextMetricsW SelectObject

winspool.drv

EnumPrintersW

uxtheme

CloseThemeData OpenThemeData

Name

.text

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

117KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-08_9816ef8beb5878654af944bcd175aa65_cobalt-strike_icedid_luca-stealer_mespinoza_njrat_ryuk

PE Signature issue

version

imm32

wtsapi32

dwmapi

advapi32

ntdll

setupapi

comctl32

oleaut32

ole32

shlwapi

kernel32

winmm

user32

shell32

gdi32

winspool.drv

uxtheme

generic