2026-10-19_591a627b479cefc43643729b920f4386_cobalt-strike_icedid_luca-stealer_njrat

General

Target
2026-10-19_591a627b479cefc43643729b920f4386_cobalt-strike_icedid_luca-stealer_njrat
Size 191KB
Sample261020-ydvx6avth1
SHA256 eb2627e8461f3a73d20611a80f9db1597c27a6b4fdefe6d665a79261d89a9914
MD5 591a627b479cefc43643729b920f4386
SHA1 7726a039e1739792934820ae528b2357e081e047
SHA512 776c3f55cc221e3f083fbbfcb17a181c0dfdaa681e7cd4bcd0bd216fe4099fbc528424efeb5c4a3a4e7625626fa4f19ddd1ffc77ad9ec294c1614e612b3c43f8
SSDEEP 3072:GNS9lQ33Ziiovmioa7+ztxyNcHR5DWnyQF0ZYehEPbX:2W46vjoaYyNcHRBkTPb
TLSH
T160146A09B3A610F5F9B782398A604616FA72B4515B30DBCF03E407699F237D19D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-19_591a627b479cefc43643729b920f4386_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-10-19_591a627b479cefc43643729b920f4386_cobalt-strike_icedid_luca-stealer_njrat

.exe 191KB

2026-10-19_591a627b479cefc43643729b920f4386_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH b978f8e04de3a683cf4858c9b6ee35af
SHA256 eb2627e8461f3a73d20611a80f9db1597c27a6b4fdefe6d665a79261d89a9914
MD5 591a627b479cefc43643729b920f4386
SHA1 7726a039e1739792934820ae528b2357e081e047
SHA512 776c3f55cc221e3f083fbbfcb17a181c0dfdaa681e7cd4bcd0bd216fe4099fbc528424efeb5c4a3a4e7625626fa4f19ddd1ffc77ad9ec294c1614e612b3c43f8
SSDEEP 3072:GNS9lQ33Ziiovmioa7+ztxyNcHR5DWnyQF0ZYehEPbX:2W46vjoaYyNcHRBkTPb
TLSH
T160146A09B3A610F5F9B782398A604616FA72B4515B30DBCF03E407699F237D19D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

27056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW CreateFileW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetStdHandle GetFileType GetModuleFileNameW WriteConsoleW WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc CloseHandle

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-19_591a627b479cefc43643729b920f4386_cobalt-strike_icedid_luca-stealer_njrat

kernel32

generic