2026-10-01_63ce090251a4ffb9e158ff4f500f66c0_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_63ce090251a4ffb9e158ff4f500f66c0_cobalt-strike_icedid_luca-stealer_njrat
Size 161KB
Sample261002-qj9phaxt2j
SHA256 bac82cf996456139d8413881015c097a4abacb52667d8853ec382a8fcc816080
MD5 63ce090251a4ffb9e158ff4f500f66c0
SHA1 31eaeed847dbcfafc259f7b2a4cc40ae47300308
SHA512 fc088da9cc1d56677d2306cfe3fd0b6dadce3f43dc826b9e965df80164f82633dc61b247a1e2972439c747ff37b03773544059bc410757443a5907055d7c81ca
SSDEEP 3072:YB6I6wRLP/VwlLhm/Y2bSjbEkVd35hBoxzY/P+3:YB/LPCl1mrGbDVd3nX+
TLSH
T1C0F35B5BB3A524F9E1B78278C9A54642F77378310B209BDF07A483766F236D05D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-01_63ce090251a4ffb9e158ff4f500f66c0_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-10-01_63ce090251a4ffb9e158ff4f500f66c0_cobalt-strike_icedid_luca-stealer_njrat

.exe 161KB

2026-10-01_63ce090251a4ffb9e158ff4f500f66c0_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 98e916facf711611087c66988fff2568
SHA256 bac82cf996456139d8413881015c097a4abacb52667d8853ec382a8fcc816080
MD5 63ce090251a4ffb9e158ff4f500f66c0
SHA1 31eaeed847dbcfafc259f7b2a4cc40ae47300308
SHA512 fc088da9cc1d56677d2306cfe3fd0b6dadce3f43dc826b9e965df80164f82633dc61b247a1e2972439c747ff37b03773544059bc410757443a5907055d7c81ca
SSDEEP 3072:YB6I6wRLP/VwlLhm/Y2bSjbEkVd35hBoxzY/P+3:YB/LPCl1mrGbDVd3nX+
TLSH
T1C0F35B5BB3A524F9E1B78278C9A54642F77378310B209BDF07A483766F236D05D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17508

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetProcAddress GlobalUnlock GlobalLock lstrcmpiW MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteConsoleW CreateFileW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize SetFilePointerEx GetModuleHandleA GetProcessHeap LCMapStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue GetFileAttributesW GetStringTypeW GetModuleFileNameA VirtualFreeEx WriteProcessMemory VirtualAllocEx GetTickCount OpenProcess CreateRemoteThread CreateThread Sleep WaitForSingleObject CloseHandle GetVolumeInformationA GetTempPathA WriteFile ReadFile GetFileSize SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType HeapAlloc HeapFree GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle RtlPcToFileHeader RaiseException EncodePointer GetFileAttributesA DeleteFileA FlsAlloc CreateFileA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW

user32

UpdateWindow BeginPaint EndPaint SetWindowRgn GetSystemMetrics GetMessageW TranslateMessage DispatchMessageW PostMessageW SetTimer PostQuitMessage RegisterClassExW CreateWindowExW ShowWindow SetWindowPos OpenClipboard CloseClipboard GetClipboardData GetKeyState SetCapture DefWindowProcW FillRect InvalidateRect LoadCursorW GetClientRect GetWindowRect ReleaseCapture

gdi32

TextOutW SetTextColor SetBkMode SelectObject RoundRect GetTextExtentPoint32W GetStockObject DeleteObject DeleteDC CreateSolidBrush CreateRoundRectRgn CreatePen CreateFontW CreateCompatibleDC CreateCompatibleBitmap BitBlt

shell32

ShellExecuteA

gdiplus

GdipFree GdiplusStartup GdiplusShutdown GdipLoadImageFromFile GdipCloneImage GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipCreateFromHDC GdipDeleteGraphics GdipSetSmoothingMode GdipSetInterpolationMode GdipDrawImageRectI GdipAlloc

wininet

InternetOpenA InternetCloseHandle InternetOpenUrlA InternetReadFile HttpOpenRequestA HttpSendRequestA InternetConnectA

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA

Name

.text

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-01_63ce090251a4ffb9e158ff4f500f66c0_cobalt-strike_icedid_luca-stealer_njrat

kernel32

user32

gdi32

shell32

gdiplus

wininet

advapi32

generic