2026-09-10_e7d1830b4873d6bac18e2835e1dbff2f_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-10_e7d1830b4873d6bac18e2835e1dbff2f_cobalt-strike_icedid_luca-stealer_njrat
Size 515KB
Sample260910-lbcbta1cra
SHA256 5d835d3a7c06eb97a9cd28cbbc54d6128579e95149c64eba13163d37ef438d11
MD5 e7d1830b4873d6bac18e2835e1dbff2f
SHA1 3b7aebafd9e115a94759c574dbdefec6525675c6
SHA512 cbd7b081770cddcb4f0367b7a42e732b648afce2a93c14a4e6c1d4139444fe32c956c19f16d008519663910be96155a3872d2f213793e4883344812a5a3f7e9a
SSDEEP 12288:1CY6GFQ+Vjn/YPUnyitxVZGbQs3ePI5u6FMLTB9grB9V:QYXFQ+ln/hnyufZU/3eA5FMfB9eB
TLSH
T108B47C6073E111DCE5F3A37A8A764626E9367D852770CADF81A0D8791F23AC0D974B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-10_e7d1830b4873d6bac18e2835e1dbff2f_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-09-10_e7d1830b4873d6bac18e2835e1dbff2f_cobalt-strike_icedid_luca-stealer_njrat

.exe 515KB

2026-09-10_e7d1830b4873d6bac18e2835e1dbff2f_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 2c8da8c6ca7419354bae34be32d826b6
SHA256 5d835d3a7c06eb97a9cd28cbbc54d6128579e95149c64eba13163d37ef438d11
MD5 e7d1830b4873d6bac18e2835e1dbff2f
SHA1 3b7aebafd9e115a94759c574dbdefec6525675c6
SHA512 cbd7b081770cddcb4f0367b7a42e732b648afce2a93c14a4e6c1d4139444fe32c956c19f16d008519663910be96155a3872d2f213793e4883344812a5a3f7e9a
SSDEEP 12288:1CY6GFQ+Vjn/YPUnyitxVZGbQs3ePI5u6FMLTB9grB9V:QYXFQ+ln/hnyufZU/3eA5FMfB9eB
TLSH
T108B47C6073E111DCE5F3A37A8A764626E9367D852770CADF81A0D8791F23AC0D974B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

232848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptHashData BCryptGetProperty BCryptOpenAlgorithmProvider BCryptImportKeyPair BCryptVerifySignature BCryptDestroyKey BCryptCreateHash BCryptGenRandom BCryptHash BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash

crypt32

CryptHashCertificate2

winhttp

WinHttpCloseHandle WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpOpenRequest WinHttpSetOption WinHttpSendRequest WinHttpSetTimeouts WinHttpReadData WinHttpQueryHeaders WinHttpConnect WinHttpOpen WinHttpReceiveResponse

wintrust

WinVerifyTrust WTHelperGetProvCertFromChain WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

advapi32

RegCloseKey CredReadW SetEntriesInAclW CredFree SetSecurityInfo ConvertSidToStringSidW CredDeleteW RegQueryValueExW GetSecurityInfo RegEnumKeyExW RegOpenKeyExW RegGetValueW CopySid IsValidSid OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW GetLengthSid GetTokenInformation CredWriteW

comctl32

InitCommonControlsEx

comdlg32

GetOpenFileNameW

dwmapi

DwmSetWindowAttribute

gdi32

Ellipse RestoreDC SetTextColor CreateSolidBrush SetBkColor FillRgn MoveToEx SelectClipRgn Rectangle CreatePen LineTo DeleteDC GetTextMetricsW CreatePolygonRgn RoundRect SetBkMode CreateRoundRectRgn GetStockObject CreateFontW CreateCompatibleDC BitBlt SelectObject SaveDC CreateCompatibleBitmap DeleteObject

iphlpapi

IcmpCloseHandle IcmpCreateFile IcmpSendEcho

msimg32

GradientFill

shell32

ord17 CommandLineToArgvW SHOpenFolderAndSelectItems ord18 ord155 ord16 ShellExecuteExW ord190 SHGetFolderPathW ShellExecuteW

shlwapi

PathIsRelativeW PathFindExtensionW PathRemoveFileSpecW StrStrIW PathFindFileNameW

user32

GetDC IsWindowVisible SetWindowPos MessageBoxW GetDpiForWindow AdjustWindowRectExForDpi SetWindowLongPtrW FillRect CreateWindowExW SendMessageW GetSystemMetrics SetWindowTextW RegisterClassExW LoadStringW ShowWindow DispatchMessageW SetTimer RedrawWindow IsDialogMessageW GetFocus GetParent TranslateMessage LoadIconW FindWindowW LoadCursorW SetCursor GetClientRect DrawTextW KillTimer PostQuitMessage CharLowerBuffW PtInRect UpdateWindow SetForegroundWindow LoadImageW InvalidateRect ReleaseDC BeginPaint EndPaint GetWindowTextW InflateRect GetWindowRect SetProcessDpiAwarenessContext DefWindowProcW GetMessageW SendMessageTimeoutW DialogBoxParamW SendDlgItemMessageW SetDlgItemTextW GetWindow EndDialog IsWindow PostMessageW SetWindowsHookExW EnumWindows UnhookWindowsHookEx SetFocus WaitForInputIdle MapWindowPoints GetWindowThreadProcessId GetWindowLongPtrW

ws2_32

GetAddrInfoW WSAStartup FreeAddrInfoW WSACleanup InetPtonW

kernel32

FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP FindClose GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW HeapSize GetConsoleOutputCP GetConsoleMode WriteConsoleW TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection RtlUnwindEx GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LoadLibraryExW Module32NextW FreeLibrary GetProcAddress Module32FirstW LoadLibraryW Sleep GetWindowsDirectoryW SetFileInformationByHandle GetPrivateProfileStringW MultiByteToWideChar SetEndOfFile CompareStringOrdinal GetPrivateProfileIntW ExpandEnvironmentStringsW WritePrivateProfileStringW InitOnceExecuteOnce GetVolumeInformationW GetSystemFirmwareTable FlushFileBuffers WideCharToMultiByte MoveFileExW SetFilePointerEx CreateThread TlsFree HeapReAlloc DeleteFileW FormatMessageW GetFileInformationByHandle GetFileSizeEx CreateDirectoryW GetExitCodeProcess ConnectNamedPipe MulDiv WaitNamedPipeW GetFileType QueryFullProcessImageNameW GetModuleHandleW GetProcessHeap GetCurrentProcessId LocalFree GetNamedPipeServerProcessId GetOverlappedResult FileTimeToLocalFileTime HeapAlloc CancelIoEx CloseHandle Process32FirstW FileTimeToSystemTime SetEvent Process32NextW GetLastError GetTickCount64 ProcessIdToSessionId CreateEventW CreateToolhelp32Snapshot OpenProcess GetModuleHandleExW ExitProcess GetStdHandle RtlPcToFileHeader RaiseException EncodePointer ReadFile SetNamedPipeHandleState GetFileInformationByHandleEx HeapFree SetLastError GetCommandLineW GetCurrentProcess WriteFile GetFinalPathNameByHandleW GetModuleFileNameW CreateNamedPipeW WaitForMultipleObjects GetProcessId GetNamedPipeClientProcessId CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetNumberFormatEx DisconnectNamedPipe

Name

.text

Size

317KB

Virtual Size

316KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-10_e7d1830b4873d6bac18e2835e1dbff2f_cobalt-strike_icedid_luca-stealer_njrat

bcrypt

crypt32

winhttp

wintrust

version

advapi32

comctl32

comdlg32

dwmapi

gdi32

iphlpapi

msimg32

shell32

shlwapi

user32

ws2_32

kernel32

generic