2026-05-28_70df2907e34cce113c17df29b7a401ef_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-05-28_70df2907e34cce113c17df29b7a401ef_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 152KB
Sample260528-fdgresfv6r
SHA256 1f029013fffb47fe90725e1aa16beabf89f715907afafb23185bdc22c950e0bc
MD5 70df2907e34cce113c17df29b7a401ef
SHA1 e7be26a67c930cfbc17331bfadd3dd5ee4c03d83
SHA512 bc6402d523b1e1e7bbf2d4237459c79e51fb934d969efd8ece2f05e3781e301d8cd0a24ac61522ebc4e8c0f92fb20c085145a798a93698f7aabf74224fdca76f
SSDEEP 3072:9Rksoi8cRlaXbZX1hnZlut4uOy8GpKhde:9kTqMvxZluTFwY
TLSH
T1FFE36C07B3A934F9E077827989A15646F772787617206BEF03A047762F236D09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-05-28_70df2907e34cce113c17df29b7a401ef_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-05-28_70df2907e34cce113c17df29b7a401ef_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 152KB

2026-05-28_70df2907e34cce113c17df29b7a401ef_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH a9851dcc3f49942cb5969529cf7eb198
SHA256 1f029013fffb47fe90725e1aa16beabf89f715907afafb23185bdc22c950e0bc
MD5 70df2907e34cce113c17df29b7a401ef
SHA1 e7be26a67c930cfbc17331bfadd3dd5ee4c03d83
SHA512 bc6402d523b1e1e7bbf2d4237459c79e51fb934d969efd8ece2f05e3781e301d8cd0a24ac61522ebc4e8c0f92fb20c085145a798a93698f7aabf74224fdca76f
SSDEEP 3072:9Rksoi8cRlaXbZX1hnZlut4uOy8GpKhde:9kTqMvxZluTFwY
TLSH
T1FFE36C07B3A934F9E077827989A15646F772787617206BEF03A047762F236D09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14724

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetCloseHandle HttpSendRequestA HttpOpenRequestA InternetQueryDataAvailable InternetReadFile InternetConnectA InternetOpenA

kernel32

GetStdHandle WriteConsoleW CreateFileW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc CreateFileA GetFileSize ReadFile GetVolumeInformationA CloseHandle WaitForSingleObject CreateRemoteThread OpenProcess GlobalMemoryStatusEx GetSystemInfo VirtualAllocEx WriteProcessMemory VirtualFreeEx GetModuleFileNameA GetProcAddress LoadLibraryA GetComputerNameA CreateToolhelp32Snapshot Process32First Process32Next HeapSize SetFilePointerEx GetProcessHeap QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW

user32

MessageBoxA

shell32

ShellExecuteA

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-28_70df2907e34cce113c17df29b7a401ef_cobalt-strike_icedid_luca-stealer_njrat_stealc

wininet

kernel32

user32

shell32

generic