2026-10-06_92a6db62b72582a44f71f9bf9b1d8f9c_cobalt-strike_icedid_luca-stealer_njrat

General

Target
2026-10-06_92a6db62b72582a44f71f9bf9b1d8f9c_cobalt-strike_icedid_luca-stealer_njrat
Size 185KB
Sample261007-3b3x7sxtdv
SHA256 09a1d3a602af293062e4666519933f4f1985e9ed3cbda1dbc1e9b79ed69362ac
MD5 92a6db62b72582a44f71f9bf9b1d8f9c
SHA1 5d62dc42a1a6c25947533924affced5990768d1b
SHA512 abc9b00b1817f41a512433fd9e5dab51b6733363db52382b4e1180d19a63a41c1e883f94a6d11b8bf0b79da3c023b38a7acd43c528611496a3502552263ff541
SSDEEP 3072:XoEiRm9Vjxjp2m7L3zpym4RdnTgKnH2PRPb3Rh83Xw:7YgBVwm7L3zpeDTNH2P2Hw
TLSH
T1B4045A1076A205F8D563E239CE144B65FAB2791A4B30578F17A80379DF23B91AD3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-06_92a6db62b72582a44f71f9bf9b1d8f9c_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-10-06_92a6db62b72582a44f71f9bf9b1d8f9c_cobalt-strike_icedid_luca-stealer_njrat

.exe 185KB

2026-10-06_92a6db62b72582a44f71f9bf9b1d8f9c_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 49d19eddc92187dbc5538b1a7318d919
SHA256 09a1d3a602af293062e4666519933f4f1985e9ed3cbda1dbc1e9b79ed69362ac
MD5 92a6db62b72582a44f71f9bf9b1d8f9c
SHA1 5d62dc42a1a6c25947533924affced5990768d1b
SHA512 abc9b00b1817f41a512433fd9e5dab51b6733363db52382b4e1180d19a63a41c1e883f94a6d11b8bf0b79da3c023b38a7acd43c528611496a3502552263ff541
SSDEEP 3072:XoEiRm9Vjxjp2m7L3zpym4RdnTgKnH2PRPb3Rh83Xw:7YgBVwm7L3zpeDTNH2P2Hw
TLSH
T1B4045A1076A205F8D563E239CE144B65FAB2791A4B30578F17A80379DF23B91AD3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

40560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualAlloc VirtualFree QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW WriteConsoleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc CloseHandle CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-06_92a6db62b72582a44f71f9bf9b1d8f9c_cobalt-strike_icedid_luca-stealer_njrat

kernel32

generic