2026-10-30_96b4c82328b64f57a86baa0845a801e4_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-30_96b4c82328b64f57a86baa0845a801e4_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 468KB
Sample261030-1lay3aff33
SHA256 0f6e42e601716c4c39d04abd12ce44be6f76ee02e141c18b9ce595b7198da30f
MD5 96b4c82328b64f57a86baa0845a801e4
SHA1 212ffcd4e98313c5e33b2bd1389c84804f7695c9
SHA512 2f8e4ed973646523cbabfad7da4c948ac1f233870cb2b1ba91c364a6b64a1f719de57dabdf0261a517c275864ea9822cb1c08b76c07d05a616a21f1642e35cb6
SSDEEP 6144:L/aChK1gcYEqzL1n36crqsDCzjo8CLVgEMbH8+97k/v1:7aCMgcMzxnKcr9jNMA+631
TLSH
T14DA48D1AE76414F5E0A7C278C9436D02DB727C4A47B1E68F07D996661F332A09E3EF12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-30_96b4c82328b64f57a86baa0845a801e4_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 468KB

2026-10-30_96b4c82328b64f57a86baa0845a801e4_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 38ed8a37a44cf26c51c91dcc6e5940f9
SHA256 0f6e42e601716c4c39d04abd12ce44be6f76ee02e141c18b9ce595b7198da30f
MD5 96b4c82328b64f57a86baa0845a801e4
SHA1 212ffcd4e98313c5e33b2bd1389c84804f7695c9
SHA512 2f8e4ed973646523cbabfad7da4c948ac1f233870cb2b1ba91c364a6b64a1f719de57dabdf0261a517c275864ea9822cb1c08b76c07d05a616a21f1642e35cb6
SSDEEP 6144:L/aChK1gcYEqzL1n36crqsDCzjo8CLVgEMbH8+97k/v1:7aCMgcMzxnKcr9jNMA+631
TLSH
T14DA48D1AE76414F5E0A7C278C9436D02DB727C4A47B1E68F07D996661F332A09E3EF12
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

06:7a:42:f6:af:4b:5a:5c:58:58:42:1c:ef:a5:fa:db:db:85:a6:d0:28:b1:1d:1e:01:84:8c:6c:18:69:0c:26

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

Chains

Oct 27, 2026

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US

Serial Number

07:60:2c:bf:6e:75:79:40:03:82:56:f0:ad:87:5e:d6

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 14, 2023 - Feb 13, 2033

Subject

SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a

Serial Number

08:3e:a1:38:84:bd:ff:ce:8e:5d:9d:5c:ad:2e:fb:de

Issuer

CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 26, 2025 - Aug 25, 2028

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

145144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

jpackageapplauncher.exe.pdb

user32

GetMessageW TranslateMessage DispatchMessageW PostMessageW CreateWindowExW AllowSetForegroundWindow

shell32

CommandLineToArgvW

kernel32

GetEnvironmentVariableW SetEndOfFile WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW HeapReAlloc GetCurrentDirectoryW ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree GetCommandLineA WriteFile CloseHandle GetLastError WaitForSingleObject GetExitCodeProcess ResumeThread CreateProcessW GetProcessId AssignProcessToJobObject SetEnvironmentVariableW GetCurrentThreadId LoadLibraryExW GetCurrentProcessId GetLocalTime FreeLibrary GetModuleHandleExW GetProcAddress LoadLibraryW LocalFree FormatMessageW CreateFileW FindClose FindNextFileW GetFileAttributesW SetLastError CreateThread CreateJobObjectW SetInformationJobObject GetModuleHandleW SetDllDirectoryW SetConsoleCtrlHandler GetCommandLineW RtlUnwind GetSystemDirectoryW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead GetStdHandle RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetFullPathNameW GetDriveTypeW ExitProcess

Name

.text

Size

298KB

Virtual Size

298KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-10-30_96b4c82328b64f57a86baa0845a801e4_cobalt-strike_icedid_luca-stealer_njrat_stealc

user32

shell32

kernel32

generic