2026-11-11_68492bf0092b40523d0a7d98f7aaf06a_cobalt-strike_icedid_luca-stealer_njrat

General

Target
2026-11-11_68492bf0092b40523d0a7d98f7aaf06a_cobalt-strike_icedid_luca-stealer_njrat
Size 457KB
Sample261113-mtfbvsaw9r
SHA256 abdeb14bbd3c2f5b4e0e95f3b2b466208f4f1128113cc2c356eb03f8fcf31104
MD5 68492bf0092b40523d0a7d98f7aaf06a
SHA1 8eba02e2de56829d9077d4f9178028ac707c8a0e
SHA512 408b98e9645799aa65895dc1a1640ebfda8c670a5a9b7fd38987fedd0eca25d4dde902bccd0a9afd19e43380eb7e5f9a86fcfda432ad871f72f1b2dbbd88dfac
SSDEEP 6144:dR+McivoM+4Dl45FXvxRyCO73Kp1uauh39Sq:HMie4x4PXvSappuZYq
TLSH
T198A46BD6A7E800E9F4B7957CD9724901FA76BC520B16C98F1790364E2E33BE08E39725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-11-11_68492bf0092b40523d0a7d98f7aaf06a_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-11-11_68492bf0092b40523d0a7d98f7aaf06a_cobalt-strike_icedid_luca-stealer_njrat

.exe 457KB

2026-11-11_68492bf0092b40523d0a7d98f7aaf06a_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 1da8a1ebee0a91746f3b5da4920af366
SHA256 abdeb14bbd3c2f5b4e0e95f3b2b466208f4f1128113cc2c356eb03f8fcf31104
MD5 68492bf0092b40523d0a7d98f7aaf06a
SHA1 8eba02e2de56829d9077d4f9178028ac707c8a0e
SHA512 408b98e9645799aa65895dc1a1640ebfda8c670a5a9b7fd38987fedd0eca25d4dde902bccd0a9afd19e43380eb7e5f9a86fcfda432ad871f72f1b2dbbd88dfac
SSDEEP 6144:dR+McivoM+4Dl45FXvxRyCO73Kp1uauh39Sq:HMie4x4PXvSappuZYq
TLSH
T198A46BD6A7E800E9F4B7957CD9724901FA76BC520B16C98F1790364E2E33BE08E39725
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

17:af:ce:8c:1f:bb:0b:1a:b7:d2:68:40:b9:41:95:a6:ac:17:84:c3:e7:b6:91:da:56:f5:37:2a:a5:cf:d3:64

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 22, 2026

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:40:2a:4a:d7:d2:31:21:a6:15:00:00:00:00:05:40

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 18, 2025 - Sep 8, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

0

Major OS version

10

Entry point

847872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ntdll

RtlPcToFileHeader RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwindEx

kernel32

CreateTimerQueueTimer LoadLibraryExW LocalFree GetCurrentThread GetSystemDirectoryW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetFileAttributesW FindNextFileW FindFirstFileExW FindClose CreateFileW SetEnvironmentVariableW TerminateProcess WriteFile WaitForSingleObject SetEvent IsDebuggerPresent DebugBreak GetModuleHandleW GetProcessHeap HeapAlloc SetThreadpoolWait CreateThreadpoolWait OutputDebugStringW ReleaseSRWLockExclusive WaitForThreadpoolWaitCallbacks FormatMessageW Sleep CloseThreadpoolWait GetCurrentThreadId GetModuleHandleExW CreateEventExW SetLastError HeapFree GetModuleFileNameA GetProcAddress FreeLibrary DeleteTimerQueueTimer DeleteCriticalSection DecodePointer CloseHandle GetLastError InitializeCriticalSectionEx GetCurrentProcess SetFilePointerEx WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW HeapSize HeapReAlloc LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetCommandLineW GetCommandLineA AcquireSRWLockExclusive GetSystemTimeAsFileTime GetStringTypeW RaiseException EncodePointer GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId InitializeSListHead GetStartupInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess IsValidCodePage GetACP GetOEMCP GetStdHandle

advapi32

OpenThreadToken ConvertSidToStringSidW GetTokenInformation EventRegister EventSetInformation EventUnregister RegEnumValueW RegNotifyChangeKeyValue RegCloseKey EventWriteTransfer RegOpenKeyExW TraceMessage OpenProcessToken

user32

SetWinEventHook GetWindowTextW UnhookWinEvent TranslateMessage DispatchMessageW GetMessageW GetWindowTextLengthW GetWindowThreadProcessId GetDesktopWindow GetWindow

Name

.text

Size

176KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

120KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

4KB

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

116KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

416KB

Virtual Size

464KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-11-11_68492bf0092b40523d0a7d98f7aaf06a_cobalt-strike_icedid_luca-stealer_njrat

PE Signature issue

ntdll

kernel32

advapi32

user32

generic