2026-10-22_9b8abb35703acb61234f47f33fcab623_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-22_9b8abb35703acb61234f47f33fcab623_cobalt-strike_icedid_luca-stealer_njrat
Size 235KB
Sample261024-ds7kaafv2s
SHA256 d22a653f32c377195b875902c838ff2dfd576f4714d55ce4915569394f127a3d
MD5 9b8abb35703acb61234f47f33fcab623
SHA1 626a80fe1d24a2d97d32c6536e95cf1cceab76cc
SHA512 714efe8eda0d4531a1e7e4faed8e3e258fcd650cc0cf350207a296fd70ad5a244cddbc44f57a4ac955a3c7d83df8ef4903539654478807007699bf685abe71d4
SSDEEP 3072:J3TW5Vp4VXE5gLWTWPxB8s74Uh0rhchkSeDHvrp1gLWy/xllC2rwK:J3TIVpgE5uWyPxB8c4weSEey
TLSH
T1BB348C4573E50CF9F5B78239CD625606D6723C511760EBDF07A046AAAF23AE04D3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_9b8abb35703acb61234f47f33fcab623_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-10-22_9b8abb35703acb61234f47f33fcab623_cobalt-strike_icedid_luca-stealer_njrat

.exe 235KB

2026-10-22_9b8abb35703acb61234f47f33fcab623_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 85752f121255631a97dd00a777e04086
SHA256 d22a653f32c377195b875902c838ff2dfd576f4714d55ce4915569394f127a3d
MD5 9b8abb35703acb61234f47f33fcab623
SHA1 626a80fe1d24a2d97d32c6536e95cf1cceab76cc
SHA512 714efe8eda0d4531a1e7e4faed8e3e258fcd650cc0cf350207a296fd70ad5a244cddbc44f57a4ac955a3c7d83df8ef4903539654478807007699bf685abe71d4
SSDEEP 3072:J3TW5Vp4VXE5gLWTWPxB8s74Uh0rhchkSeDHvrp1gLWy/xllC2rwK:J3TIVpgE5uWyPxB8c4weSEey
TLSH
T1BB348C4573E50CF9F5B78239CD625606D6723C511760EBDF07A046AAAF23AE04D3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

38152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpReceiveResponse WinHttpOpen WinHttpConnect

user32

GetWindowTextW PostQuitMessage GetClassNameW TranslateMessage GetMessageA PostMessageW DispatchMessageA EnumChildWindows PostMessageA GetSystemMetrics GetClassNameA SetTimer GetWindowTextA ShutdownBlockReasonCreate RegisterClassA EnumWindows DefWindowProcA CreateWindowExA

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCloseKey

kernel32

FlushFileBuffers HeapSize SetFilePointerEx GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetConsoleOutputCP GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetTimeZoneInformation GetConsoleMode WriteConsoleW GetCommandLineA GetCurrentProcess CreateDirectoryW GetModuleFileNameA GetFileSizeEx SearchPathW WriteFile ExpandEnvironmentStringsW GetModuleFileNameW CreateHardLinkW CreateMutexA WaitForSingleObject CreateFileW GetFileAttributesW ReleaseMutex GetModuleHandleA OpenProcess SetFileAttributesW CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetLastError Process32NextW GetDiskFreeSpaceExW LoadLibraryA QueryPerformanceFrequency DeleteFileW Process32FirstW CloseHandle GetSystemInfo CreateThread GetProcAddress GlobalMemoryStatusEx CreateProcessW CopyFileW CreateProcessA QueryPerformanceCounter GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType WideCharToMultiByte FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetNumberValue cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithLength cJSON_ParseWithLengthOpts cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_SetValuestring cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

163KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_9b8abb35703acb61234f47f33fcab623_cobalt-strike_icedid_luca-stealer_njrat

winhttp

user32

wtsapi32

advapi32

kernel32

generic