2026-05-11_6a03b941a7c72e19c344bd93fd1c6ff5_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-11_6a03b941a7c72e19c344bd93fd1c6ff5_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 252KB
Sample260511-vd71yaav9l
SHA256 c4ae75478e330a1274cad36ae0488b43d398b8529b45531da19e08bf5b0e0ddc
MD5 6a03b941a7c72e19c344bd93fd1c6ff5
SHA1 f12426044ee91d2be367cb2568ff6639f1ac0a1a
SHA512 fc4fd2a3fd8c799bdbb5ac0c2affd360c6790919e1120f1d87089c04583ecaa761b4994db862354d5370fbde5ce0bc3647f4249e7e4d475c5f34fab5581406cb
SSDEEP 3072:bKDHwN1H92IB/UWs467NqmM68C508OssDofC0mWVX/BR0oB0sxIG:bgwH8Ilh+qT6O0jbasCG
TLSH
T1E1449C9AA75448EDCD3BA470D8110585E732B8FEC790F9CB53E522B65E936E05E3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-11_6a03b941a7c72e19c344bd93fd1c6ff5_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-05-11_6a03b941a7c72e19c344bd93fd1c6ff5_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 252KB

2026-05-11_6a03b941a7c72e19c344bd93fd1c6ff5_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH a5c5bf52f6beec80e75cfda3c4a1994d
SHA256 c4ae75478e330a1274cad36ae0488b43d398b8529b45531da19e08bf5b0e0ddc
MD5 6a03b941a7c72e19c344bd93fd1c6ff5
SHA1 f12426044ee91d2be367cb2568ff6639f1ac0a1a
SHA512 fc4fd2a3fd8c799bdbb5ac0c2affd360c6790919e1120f1d87089c04583ecaa761b4994db862354d5370fbde5ce0bc3647f4249e7e4d475c5f34fab5581406cb
SSDEEP 3072:bKDHwN1H92IB/UWs467NqmM68C508OssDofC0mWVX/BR0oB0sxIG:bgwH8Ilh+qT6O0jbasCG
TLSH
T1E1449C9AA75448EDCD3BA470D8110585E732B8FEC790F9CB53E522B65E936E05E3DB00
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

38276

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2021pd_D20250929T174559\fa_rss\AppStoreSRV\x64\Release\AppStoreSRV.pdb

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

kernel32

FindResourceExW GetLastError CreateEventW CreateThread SetEvent GetFileAttributesW DeleteFileW FindFirstFileW FindClose FindNextFileW RemoveDirectoryW CopyFileW Sleep MultiByteToWideChar LocalFree FindResourceW GetCurrentProcess LocalAlloc ReleaseMutex CreateMutexW CreateFileMappingW MapViewOfFile WaitForMultipleObjects UnmapViewOfFile InitializeCriticalSectionEx DeleteCriticalSection GetConsoleMode GetConsoleOutputCP FlushFileBuffers LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy GetCommandLineW WaitForSingleObject CloseHandle GetExitCodeProcess CreateFileW WriteConsoleW TerminateProcess GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetFileType SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte

user32

wsprintfW

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor ConvertSidToStringSidW CreateProcessAsUserW GetLengthSid SetTokenInformation ConvertStringSidToSidW DuplicateTokenEx GetTokenInformation SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

CommandLineToArgvW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Name

.text

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

69KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-11_6a03b941a7c72e19c344bd93fd1c6ff5_cobalt-strike_icedid_luca-stealer_njrat_stealc

wtsapi32

kernel32

user32

advapi32

shell32

userenv

generic