2026-10-22_4c0d77f9286a8fd695bc97323a4e8a7d_cobalt-strike_icedid_luca-stealer_njrat

General

Target
2026-10-22_4c0d77f9286a8fd695bc97323a4e8a7d_cobalt-strike_icedid_luca-stealer_njrat
Size 183KB
Sample261024-raz95sb18n
SHA256 adad32e859a0ab2eca6f6558704345f3dd6bac5d155362c99116db63891ddc98
MD5 4c0d77f9286a8fd695bc97323a4e8a7d
SHA1 a4c5e469537f52e004c585d7abacb2f78f54fff2
SHA512 1f62b9e3e0d4d3f009e0367c578a63df1bfceb897211e7a6164513a3ac2f4a60ee16db1649466d0e1754b873fc38436b871882f7012007a25c5299245e31797a
SSDEEP 3072:eOgLOgWutKRsKkfAecM0PXRq7PLxpW/bUJheGL/S3cnUUN:pgWutKaasBPnsbZ
TLSH
T1E2049D55B7A500F9E0B78238C9115A42FBB2785207609BDF07A81375EF273E16D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-22_4c0d77f9286a8fd695bc97323a4e8a7d_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-10-22_4c0d77f9286a8fd695bc97323a4e8a7d_cobalt-strike_icedid_luca-stealer_njrat

.exe 183KB

2026-10-22_4c0d77f9286a8fd695bc97323a4e8a7d_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 47cbc54cb18a72d8fe37455bbf7f0bc0
SHA256 adad32e859a0ab2eca6f6558704345f3dd6bac5d155362c99116db63891ddc98
MD5 4c0d77f9286a8fd695bc97323a4e8a7d
SHA1 a4c5e469537f52e004c585d7abacb2f78f54fff2
SHA512 1f62b9e3e0d4d3f009e0367c578a63df1bfceb897211e7a6164513a3ac2f4a60ee16db1649466d0e1754b873fc38436b871882f7012007a25c5299245e31797a
SSDEEP 3072:eOgLOgWutKRsKkfAecM0PXRq7PLxpW/bUJheGL/S3cnUUN:pgWutKaasBPnsbZ
TLSH
T1E2049D55B7A500F9E0B78238C9115A42FBB2785207609BDF07A81375EF273E16D3EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

DispatchMessageA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetWindowThreadProcessId EnumWindows GetWindowLongPtrA GetWindowTextA ReleaseDC GetDC GetSystemMetrics GetKeyNameTextA PeekMessageA TranslateMessage

gdi32

GetDIBits DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt SelectObject

kernel32

GetConsoleOutputCP FlushFileBuffers GetProcessHeap GetFileSizeEx SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW SetFilePointerEx HeapSize HeapReAlloc WriteConsoleW ReadFile SetEndOfFile GetStringTypeW FreeLibrary GetStdHandle CloseHandle GetLastError Sleep TerminateProcess OpenProcess GetTickCount GetModuleHandleA GetConsoleMode SetConsoleMode SetConsoleCtrlHandler CreateToolhelp32Snapshot Process32First Process32Next RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetEnvironmentStringsW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetConsoleCP WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapAlloc WideCharToMultiByte CreateFileW GetNumberOfConsoleInputEvents ReadConsoleInputW PeekConsoleInputA ReadConsoleW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetFileType GetTimeZoneInformation MultiByteToWideChar FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo

Name

.text

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-22_4c0d77f9286a8fd695bc97323a4e8a7d_cobalt-strike_icedid_luca-stealer_njrat

user32

gdi32

kernel32

generic