2026-10-22_d0dd7a24fbbc4816d963849b787419b9_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_d0dd7a24fbbc4816d963849b787419b9_cobalt-strike_icedid_luca-stealer_njrat
Size 185KB
Sample261023-yd2eyadv2v
SHA256 9140e874526af161fa396ee2f52147bc351c21716b582f6707c1cf3ab95a7070
MD5 d0dd7a24fbbc4816d963849b787419b9
SHA1 cc621b4ca8252b55612552ca8e24cefa21d8001d
SHA512 22a547595248cb7cbec750e923b2f01c7bb94a55f1cf7a2d6fab30f3e078a8929cf1be2285bd1becb3bab150d38c627b8d5764f1f287caef10474241f5f45b18
SSDEEP 3072:KOqpw/RWB1pIwuMw0HhPmmoycUfWtTQMA06cqk/INJWqw62:/jUBIwuz0JBoFUfghY7C6
TLSH
T159045B45B3A500FAE177C17889A11916F7B2781507209BEF07A443B6EF277E06D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_d0dd7a24fbbc4816d963849b787419b9_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-10-22_d0dd7a24fbbc4816d963849b787419b9_cobalt-strike_icedid_luca-stealer_njrat

.exe 185KB

2026-10-22_d0dd7a24fbbc4816d963849b787419b9_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH f0cebd1539841e3377111f5ee925a164
SHA256 9140e874526af161fa396ee2f52147bc351c21716b582f6707c1cf3ab95a7070
MD5 d0dd7a24fbbc4816d963849b787419b9
SHA1 cc621b4ca8252b55612552ca8e24cefa21d8001d
SHA512 22a547595248cb7cbec750e923b2f01c7bb94a55f1cf7a2d6fab30f3e078a8929cf1be2285bd1becb3bab150d38c627b8d5764f1f287caef10474241f5f45b18
SSDEEP 3072:KOqpw/RWB1pIwuMw0HhPmmoycUfWtTQMA06cqk/INJWqw62:/jUBIwuz0JBoFUfghY7C6
TLSH
T159045B45B3A500FAE177C17889A11916F7B2781507209BEF07A443B6EF277E06D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

htons connect WSAIoctl recv select send setsockopt shutdown socket gethostbyname WSAGetLastError closesocket WSAStartup

winmm

timeGetTime

bcrypt

BCryptGetProperty BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptOpenAlgorithmProvider

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

kernel32

SetFilePointerEx GetStringTypeW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetEnvironmentVariableW CreateDirectoryW CreateFileW DeleteFileW SetFileAttributesW CloseHandle GetLastError WaitForSingleObject CreateMutexA Sleep GetCurrentProcessId GetExitCodeProcess CreateProcessA ProcessIdToSessionId VirtualAlloc HeapSize GetModuleFileNameW lstrlenW CopyFileW MoveFileExW WTSGetActiveConsoleSessionId WideCharToMultiByte QueryPerformanceCounter CancelIo SetEvent ResetEvent CreateEventW GetTickCount GetSystemDirectoryA GetModuleHandleA GetProcAddress LoadLibraryA SetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcess FlushInstructionCache GetSystemInfo VirtualProtect FreeLibrary IsDebuggerPresent CheckRemoteDebuggerPresent SetUnhandledExceptionFilter ExitProcess GetLocalTime LoadLibraryW lstrcpynW CreateToolhelp32Snapshot Process32FirstW Process32NextW FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW VirtualFree LCMapStringW ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx

advapi32

RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCreateKeyW RegCloseKey RegSetValueExW

user32

wsprintfW

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW

Name

.text

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msdncfg

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_d0dd7a24fbbc4816d963849b787419b9_cobalt-strike_icedid_luca-stealer_njrat

ws2_32

winmm

bcrypt

shell32

ole32

kernel32

advapi32

user32

wtsapi32

generic