2026-11-01_f0e70d50489a22ff86533295c23e3887_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-01_f0e70d50489a22ff86533295c23e3887_cobalt-strike_icedid_luca-stealer_njrat
Size 156KB
Sample261102-d41wwazxew
SHA256 226831343a442163c99907f73ea6cb761317ff47c7b51b6196fbe9b7c3777a13
MD5 f0e70d50489a22ff86533295c23e3887
SHA1 08058ef7d4e3faa5885456d82099d7d62b1f999c
SHA512 2ad69bc5c603a1d1f4136363edd41545c78b82bd0b83ac1d63e348b6afd1c4658b4db07b2caa5f22dcae2ec2bc499d579453597577d6d329ee0af4c324d91027
SSDEEP 3072:wrf0u6fQ1b0KPDzziRUX2dhJ50XiKoLtyqWfLom:wrb6I1zNX2dH5Jt5Wft
TLSH
T1ACF35B5B73E530F9E4B3823889A50646E772B87607209BDF43A493752F232D19D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_f0e70d50489a22ff86533295c23e3887_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-11-01_f0e70d50489a22ff86533295c23e3887_cobalt-strike_icedid_luca-stealer_njrat

.exe 156KB

2026-11-01_f0e70d50489a22ff86533295c23e3887_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 5f2252304805e0899342933d594574d3
SHA256 226831343a442163c99907f73ea6cb761317ff47c7b51b6196fbe9b7c3777a13
MD5 f0e70d50489a22ff86533295c23e3887
SHA1 08058ef7d4e3faa5885456d82099d7d62b1f999c
SHA512 2ad69bc5c603a1d1f4136363edd41545c78b82bd0b83ac1d63e348b6afd1c4658b4db07b2caa5f22dcae2ec2bc499d579453597577d6d329ee0af4c324d91027
SSDEEP 3072:wrf0u6fQ1b0KPDzziRUX2dhJ50XiKoLtyqWfLom:wrb6I1zNX2dH5Jt5Wft
TLSH
T1ACF35B5B73E530F9E4B3823889A50646E772B87607209BDF43A493752F232D19D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

newdev

UpdateDriverForPlugAndPlayDevicesW

setupapi

SetupDiEnumDeviceInfo SetupDiGetClassDevsA SetupDiGetDeviceRegistryPropertyA SetupCopyOEMInfW SetupDiSetDeviceRegistryPropertyA

kernel32

GetFileSizeEx ReadFile SetLastError GetFullPathNameW WriteFile SetFilePointer WaitForSingleObject GetVersionExW GetModuleHandleA CreateEventW MultiByteToWideChar SetFilePointerEx GetLastError CreateFileA SetEvent LoadLibraryA CloseHandle GetOverlappedResult GetProcAddress GetFileSize FreeLibrary WideCharToMultiByte FormatMessageA GetConsoleMode HeapSize HeapReAlloc CreateFileW WriteConsoleW Sleep TlsAlloc GetConsoleOutputCP FlushFileBuffers RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap

advapi32

RegQueryValueExA RegCreateKeyExA RegSetValueExA ConvertStringSidToSidA RegDeleteValueA RegCloseKey

ole32

CoInitializeEx CoCreateInstance

Name

.text

Size

95KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-01_f0e70d50489a22ff86533295c23e3887_cobalt-strike_icedid_luca-stealer_njrat

newdev

setupapi

kernel32

advapi32

ole32

generic