2026-05-25_2e73c5747e3b83522f6d57f4fa70e70b_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-05-25_2e73c5747e3b83522f6d57f4fa70e70b_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 158KB
Sample260525-ltakyacy4q
SHA256 871b285de8bd30efda7383ce67d36955bf40f277ef8a8ad7167cf609112ef6ce
MD5 2e73c5747e3b83522f6d57f4fa70e70b
SHA1 bec43f6607e80e4b2a89afdb4de9ca25a35ab580
SHA512 3725605bd69e9f97c3d53546eed3caa37826d0d3d99facbe63720e76e40da3ae49864952026c835323ab5a21b8aaec558ccc0aefd58e16a2f859683a7bb8ea51
SSDEEP 3072:wQjDu4LClUtCxeI/XGczej0rAd0qbKPtBbadr/Vw0v:wr4QiCxSborA6GRC0v
TLSH
T16BF36D97B3A530F9E0778139C9A14A46E772783517209BDF03A0477A2F236E09D3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-25_2e73c5747e3b83522f6d57f4fa70e70b_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-05-25_2e73c5747e3b83522f6d57f4fa70e70b_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 158KB

2026-05-25_2e73c5747e3b83522f6d57f4fa70e70b_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 82d2223180f2980b258c51acc06520ca
SHA256 871b285de8bd30efda7383ce67d36955bf40f277ef8a8ad7167cf609112ef6ce
MD5 2e73c5747e3b83522f6d57f4fa70e70b
SHA1 bec43f6607e80e4b2a89afdb4de9ca25a35ab580
SHA512 3725605bd69e9f97c3d53546eed3caa37826d0d3d99facbe63720e76e40da3ae49864952026c835323ab5a21b8aaec558ccc0aefd58e16a2f859683a7bb8ea51
SSDEEP 3072:wQjDu4LClUtCxeI/XGczej0rAd0qbKPtBbadr/Vw0v:wr4QiCxSborA6GRC0v
TLSH
T16BF36D97B3A530F9E0778139C9A14A46E772783517209BDF03A0477A2F236E09D3EB65
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

8752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Sources\ETC\tpm-spoofer-main\tpm-info\x64\Release\tpm-info.pdb

ncrypt

NCryptGetProperty NCryptOpenStorageProvider

crypt32

CryptEncodeObjectEx

advapi32

CryptAcquireContextW CryptCreateHash CryptHashData CryptDestroyHash CryptReleaseContext CryptGetHashParam

kernel32

WriteConsoleW GetModuleHandleExW CreateFileW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc CloseHandle

Name

.text

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

648B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-25_2e73c5747e3b83522f6d57f4fa70e70b_cobalt-strike_icedid_luca-stealer_njrat_stealc

ncrypt

crypt32

advapi32

kernel32

generic