2026-05-03_bd5b20836b5030779857eb2dcb960b53_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-03_bd5b20836b5030779857eb2dcb960b53_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 767KB
Sample260503-pg3bzahs3z
SHA256 b332611c9c6928b0a0b3072886b0039587002df74a0fb3672d0cbc5100596570
MD5 bd5b20836b5030779857eb2dcb960b53
SHA1 b393eddca2133e51ebf6cef9cfaf2f68787f5b37
SHA512 8754fd41fd50e448b01eaf28a946842d34b95ead3faefb9a012cdd53cc977ec8e96a641b222ade07299c2a95fabb7006fdb320dec9d02747408ec26cf6500ad4
SSDEEP 12288:CRJhT6krJ1ASaaRSKzHkRV8JUph0lhSMXl+HCZ1N6i3ah:CLhTxrJ1ASaakKD0VVh0lhSMXlMCp6i+
TLSH
T142F4AD2AAAE441ECC57BC0BAC5620649FBB2BC9643506BCF139135672F736E85D3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-03_bd5b20836b5030779857eb2dcb960b53_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-05-03_bd5b20836b5030779857eb2dcb960b53_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 767KB

2026-05-03_bd5b20836b5030779857eb2dcb960b53_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 9667571fa43261ce843cfd46b10861fd
SHA256 b332611c9c6928b0a0b3072886b0039587002df74a0fb3672d0cbc5100596570
MD5 bd5b20836b5030779857eb2dcb960b53
SHA1 b393eddca2133e51ebf6cef9cfaf2f68787f5b37
SHA512 8754fd41fd50e448b01eaf28a946842d34b95ead3faefb9a012cdd53cc977ec8e96a641b222ade07299c2a95fabb7006fdb320dec9d02747408ec26cf6500ad4
SSDEEP 12288:CRJhT6krJ1ASaaRSKzHkRV8JUph0lhSMXl+HCZ1N6i3ah:CLhTxrJ1ASaakKD0VVh0lhSMXlMCp6i+
TLSH
T142F4AD2AAAE441ECC57BC0BAC5620649FBB2BC9643506BCF139135672F736E85D3E701
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

289772

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2040_D20260225T165711\fa_rss\Release\Watchdog.pdb

urlmon

URLDownloadToFileW

advapi32

RegCreateKeyExW RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

CommandLineToArgvW SHGetFolderPathW

kernel32

ReadConsoleW SetFilePointerEx GetConsoleMode IsValidCodePage GetACP GetOEMCP GetCommandLineA SetStdHandle WriteConsoleW SetEndOfFile GetFileSizeEx GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc CreateFileW GetFileSize ReadFile CloseHandle SetEvent CreateEventW OpenEventW CreateToolhelp32Snapshot Process32FirstW Process32NextW WaitForSingleObject Sleep WideCharToMultiByte MultiByteToWideChar GetModuleFileNameW ExpandEnvironmentStringsW GetFileAttributesW GetLastError FindClose FindFirstFileExW FindNextFileW FindFirstFileW GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW LocalFree GetSystemFirmwareTable HeapFree InitializeCriticalSectionEx HeapSize HeapReAlloc HeapAlloc DecodePointer DeleteCriticalSection GetProcessHeap WriteFile GetStdHandle GetModuleHandleExW ExitProcess LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RtlPcToFileHeader RaiseException OutputDebugStringW InitializeSListHead GetCurrentProcessId FormatMessageA GetLocaleInfoEx RtlUnwind GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetModuleHandleW GetProcAddress GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection EncodePointer GetSystemTimeAsFileTime LCMapStringEx CompareStringEx GetCPInfo WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcess TerminateProcess

winhttp

WinHttpSetOption WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpConnect WinHttpOpen WinHttpReceiveResponse WinHttpCloseHandle WinHttpReadData

Name

.text

Size

435KB

Virtual Size

435KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

251KB

Virtual Size

251KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-03_bd5b20836b5030779857eb2dcb960b53_cobalt-strike_icedid_luca-stealer_njrat_stealc

urlmon

advapi32

shell32

kernel32

winhttp

generic