stealc | 2026-05-12_815790904e1db2e601882abfad346918_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-05-12_815790904e1db2e601882abfad346918_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 767KB
Sample260512-d87j8aes71
SHA256 5b1ba8a585c22564186df808090d72d7b545d21e2c4464acb8aa1695e966e8c0
MD5 815790904e1db2e601882abfad346918
SHA1 4fe734ae7cbec75a267930de9367839b84c298ee
SHA512 ef9e5271dd189dbd1a4fa86749c7943d251eec82be7d892b1ec4209edcc0d5c9d3cff5561f2fac8fd4ebe2a274198e83b32a0e9c97bf2eea0630115d7524ef3f
SSDEEP 12288:qb5Hpg92Ojf14sHYOFYTPIP1LvM6ecgyxBlDetAqxSv:85Mjf19HwUdL07cgyb
TLSH
T1AEF47C1EE7A612F8D0B7C274CA428553E77278465370978F03E15AAA5F3B2905F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

new stealer stealc

Malware Config

Extracted

Family

stealc

Botnet

NEW

C2

http://2.26.123.18

Attributes

url_path
/0f1da281ab93408e9369.php

rc4.traffic_key

rc4.C2

Signatures

Family: Stealc
Stealc is an infostealer written in C++.
stealer stealc

Detects Stealc stealer Version 2 1 IoCs

resource	yara_rule
sample	family_stealc_v2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-12_815790904e1db2e601882abfad346918_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-05-12_815790904e1db2e601882abfad346918_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 767KB

2026-05-12_815790904e1db2e601882abfad346918_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH c5a49d74dbeba2b4cb56b327e236efe3
SHA256 5b1ba8a585c22564186df808090d72d7b545d21e2c4464acb8aa1695e966e8c0
MD5 815790904e1db2e601882abfad346918
SHA1 4fe734ae7cbec75a267930de9367839b84c298ee
SHA512 ef9e5271dd189dbd1a4fa86749c7943d251eec82be7d892b1ec4209edcc0d5c9d3cff5561f2fac8fd4ebe2a274198e83b32a0e9c97bf2eea0630115d7524ef3f
SSDEEP 12288:qb5Hpg92Ojf14sHYOFYTPIP1LvM6ecgyxBlDetAqxSv:85Mjf19HwUdL07cgyb
TLSH
T1AEF47C1EE7A612F8D0B7C274CA428553E77278465370978F03E15AAA5F3B2905F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Stealc stealer Version 2
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

291696

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleFileNameA LoadLibraryA GetProcAddress GetCurrentProcess SetEndOfFile QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW Sleep GetCurrentThreadId WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetLocaleInfoEx InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW ExitProcess WriteFile HeapFree HeapAlloc OutputDebugStringW GetTimeZoneInformation GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode CloseHandle FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle CreateFileW HeapSize RtlUnwind

Name

.text

Size

462KB

Virtual Size

464KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

106KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

177KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-05-12_815790904e1db2e601882abfad346918_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

generic