2026-09-19_51ca949d215ef015e193532860c0db27_cobalt-strike_icedid_luca-stealer_njrat

General

Target
2026-09-19_51ca949d215ef015e193532860c0db27_cobalt-strike_icedid_luca-stealer_njrat
Size 624KB
Sample260919-rb2vcssshw
SHA256 dff0f44db8e4b1eed7d58557a841c03612aaccf41b77b28dfc67be8d6ca919ce
MD5 51ca949d215ef015e193532860c0db27
SHA1 e19e2acae76a77dc4df216d33b850874728a3863
SHA512 e2096b613becadcf8a9d6454a03225b8fc4515ed3b126c6fbc48cac2521f136bab30b442c195f454aea570201f44ea7a1e9e5273e7198eb61e80665b9f1a8a55
SSDEEP 12288:A5W+Ec9SeOUbXo3Q58gxom3c2xlBHyMt3IcHKK21sY1SHu4sG:AbSefbcF2F73htO4sG
TLSH
T18DD4AED6DE9364E3D06BDA31907122174B7AE1226B1C97570258C75E2EE3CF4CEEBA40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-19_51ca949d215ef015e193532860c0db27_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-09-19_51ca949d215ef015e193532860c0db27_cobalt-strike_icedid_luca-stealer_njrat

.exe 624KB

2026-09-19_51ca949d215ef015e193532860c0db27_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 042e8f4e1f235851303bbb90da8eab9f
SHA256 dff0f44db8e4b1eed7d58557a841c03612aaccf41b77b28dfc67be8d6ca919ce
MD5 51ca949d215ef015e193532860c0db27
SHA1 e19e2acae76a77dc4df216d33b850874728a3863
SHA512 e2096b613becadcf8a9d6454a03225b8fc4515ed3b126c6fbc48cac2521f136bab30b442c195f454aea570201f44ea7a1e9e5273e7198eb61e80665b9f1a8a55
SSDEEP 12288:A5W+Ec9SeOUbXo3Q58gxom3c2xlBHyMt3IcHKK21sY1SHu4sG:AbSefbcF2F73htO4sG
TLSH
T18DD4AED6DE9364E3D06BDA31907122174B7AE1226B1C97570258C75E2EE3CF4CEEBA40
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileA DeleteFileA FlushFileBuffers GetFileSize ReadFile WriteFile GetTempPathA IsDebuggerPresent CheckRemoteDebuggerPresent CloseHandle WaitForSingleObject CreateDirectoryA GetCurrentProcess GetCurrentProcessId GetExitCodeProcess GetCurrentThreadId CreateProcessA GetTickCount VirtualAlloc VirtualFree GetModuleFileNameA lstrcatA lstrlenA WriteConsoleW Sleep GetEnvironmentVariableA QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW ExitProcess TerminateProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc GetConsoleOutputCP GetConsoleMode CreateFileW

advapi32

GetUserNameA

Name

.text

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-09-19_51ca949d215ef015e193532860c0db27_cobalt-strike_icedid_luca-stealer_njrat

kernel32

advapi32

generic