2026-10-19_6ed4bc686d60fe07fda26b3f3305b010_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-19_6ed4bc686d60fe07fda26b3f3305b010_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 183KB
Sample261020-vg366act2t
SHA256 3906e290b81afe2c538b874bd970ccee00416fa0bd09e1cb58083474e69009ef
MD5 6ed4bc686d60fe07fda26b3f3305b010
SHA1 af7418da905664bfaa26bd6935d94bee01eb1cb9
SHA512 0127b2dc4c463690b88a6cd58bc1411f286394e750792b0ab2d2dd88cef10317094ba454b5f540cd3c2aaac28118902abe6ad333e3a14279c339aedbf96d4b3d
SSDEEP 3072:dHtEpKBfMBqtqOsyt3cat/94urj2pqqpocYzUwyBp84H/CRAcK8:QABKLZyVx7qnCAo
TLSH
T13C047C56B3B510E9E2B78138C9915A05F77278620760DBDF03A043BA6F177D1AD3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
2026-10-19_6ed4bc686d60fe07fda26b3f3305b010_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-10-19_6ed4bc686d60fe07fda26b3f3305b010_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 183KB

2026-10-19_6ed4bc686d60fe07fda26b3f3305b010_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 58207680f8820d65dfd8e44d33326139
SHA256 3906e290b81afe2c538b874bd970ccee00416fa0bd09e1cb58083474e69009ef
MD5 6ed4bc686d60fe07fda26b3f3305b010
SHA1 af7418da905664bfaa26bd6935d94bee01eb1cb9
SHA512 0127b2dc4c463690b88a6cd58bc1411f286394e750792b0ab2d2dd88cef10317094ba454b5f540cd3c2aaac28118902abe6ad333e3a14279c339aedbf96d4b3d
SSDEEP 3072:dHtEpKBfMBqtqOsyt3cat/94urj2pqqpocYzUwyBp84H/CRAcK8:QABKLZyVx7qnCAo
TLSH
T13C047C56B3B510E9E2B78138C9915A05F77278620760DBDF03A043BA6F177D1AD3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Digest

64:45:b7:b9:9a:fa:a9:ed:9e:af:0c:e8:9d:8e:af:5b:c8:4f:8e:f7:3f:1c:4f:73:5b:5d:b3:45:12:a1:49:90:d0:57:8c:76:d3:e1:2b:75:7e:50:d9:8d:91:b9:07:fb

Digest Algorithm

sha384

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 11, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ec:bb:00:31:e6:4d:c1:9b:1e:00:00:00:00:00:ec

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 19, 2025 - Jun 17, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:4C1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:18:25:d9:92:05:e2:e7:e5:e4:00:01:00:00:02:18

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Aug 14, 2025 - Nov 13, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

28656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\__w\1\s\src\GameInput\build\amd64\exe\gameinputrawinputproxy\RelWithDebInfo\GameInputRawInputProxy.pdb

api-ms-win-core-debug-l1-1-0

DebugBreak OutputDebugStringW IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException SetLastError GetLastError

api-ms-win-core-heap-l1-1-0

HeapReAlloc HeapSize GetProcessHeap HeapFree HeapAlloc

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx ReleaseMutex WaitForSingleObjectEx CreateEventExW ReleaseSemaphore CreateMutexExW WaitForSingleObject EnterCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection CreateSemaphoreExW OpenSemaphoreW

api-ms-win-core-processthreads-l1-1-0

ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentProcessId TerminateProcess GetCurrentProcess GetStartupInfoW GetCurrentThreadId

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA GetModuleHandleW GetModuleFileNameW LoadLibraryExW FreeLibrary GetModuleHandleExW GetProcAddress

api-ms-win-core-localization-l1-2-0

GetOEMCP FormatMessageW IsValidCodePage LCMapStringW GetCPInfo GetACP

api-ms-win-core-string-l1-1-0

GetStringTypeW WideCharToMultiByte MultiByteToWideChar

api-ms-win-eventing-provider-l1-1-0

EventSetInformation EventUnregister EventRegister EventWriteTransfer

api-ms-win-core-file-l1-1-0

WriteFile GetFileType SetFilePointerEx FindNextFileW CreateFileW FlushFileBuffers FindFirstFileExW FindClose

user32

GetRawInputData RegisterRawInputDevices GetRawInputBuffer DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW GetMessageW TranslateMessage DispatchMessageW

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineA GetCommandLineW SetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle

api-ms-win-core-fibers-l1-1-0

FlsAlloc FlsGetValue FlsFree FlsSetValue

api-ms-win-core-memory-l1-1-0

VirtualProtect

api-ms-win-core-console-l1-1-0

WriteConsoleW GetConsoleMode GetConsoleOutputCP

Name

.text

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_6ed4bc686d60fe07fda26b3f3305b010_cobalt-strike_icedid_luca-stealer_njrat_stealc

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-file-l1-1-0

user32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-fibers-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-console-l1-1-0

generic