2026-10-19_6c7015e9390f0f360192d6b7a0f20179_cobalt-strike_icedid_luca-stealer_njrat

General

Target
2026-10-19_6c7015e9390f0f360192d6b7a0f20179_cobalt-strike_icedid_luca-stealer_njrat
Size 500KB
Sample261020-vs48lace39
SHA256 e1961d4b7acb3179aeb69ee692f6105c392b85ff2c8f18a5a920c70543305f77
MD5 6c7015e9390f0f360192d6b7a0f20179
SHA1 6fa3a132c74e48943608088910027384a9b2e954
SHA512 d71bb3aabb6af06c234e0e53d25f7cebb67c0a83491b42f3ded5b9f5511cfba69acfcb30954d22256086f25ce75107b5595ce04a58d6a5fbabc7b0fafb86fbc2
SSDEEP 12288:i2mG5b/Rk3SjYEXS/s5hZOM44WOSUFrDNVbmWEh:i2XRk33SS/8ZOrAlrDNVi
TLSH
T16CB4024BB3A536E5E0A7D235C5A14581EB32787247109BEF43E4A7612F236D08D3AB72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_6c7015e9390f0f360192d6b7a0f20179_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-10-19_6c7015e9390f0f360192d6b7a0f20179_cobalt-strike_icedid_luca-stealer_njrat

.exe 500KB

2026-10-19_6c7015e9390f0f360192d6b7a0f20179_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 8f132b0d040842398ed264d9e395a584
SHA256 e1961d4b7acb3179aeb69ee692f6105c392b85ff2c8f18a5a920c70543305f77
MD5 6c7015e9390f0f360192d6b7a0f20179
SHA1 6fa3a132c74e48943608088910027384a9b2e954
SHA512 d71bb3aabb6af06c234e0e53d25f7cebb67c0a83491b42f3ded5b9f5511cfba69acfcb30954d22256086f25ce75107b5595ce04a58d6a5fbabc7b0fafb86fbc2
SSDEEP 12288:i2mG5b/Rk3SjYEXS/s5hZOM44WOSUFrDNVbmWEh:i2XRk33SS/8ZOrAlrDNVi
TLSH
T16CB4024BB3A536E5E0A7D235C5A14581EB32787247109BEF43E4A7612F236D08D3AB72
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

6464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileA DeleteFileA FlushFileBuffers GetFileSize ReadFile WriteFile GetTempPathA CloseHandle Sleep GetCurrentProcessId CreateProcessA GetTickCount VirtualAlloc VirtualFree GetModuleFileNameA lstrcpynA lstrcpyA lstrcatA MoveFileExA WriteConsoleW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc GetConsoleOutputCP GetConsoleMode CreateFileW

Name

.wuquqi

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.qlxkrj

Size

42KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.byebjf

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fpkull

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.frorrq

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bbfgug

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.nzwesj

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_6c7015e9390f0f360192d6b7a0f20179_cobalt-strike_icedid_luca-stealer_njrat

kernel32

generic