2026-06-01_15d20e3c2d28464b44bcda77eb5fc537_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-06-01_15d20e3c2d28464b44bcda77eb5fc537_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 324KB
Sample260601-3cn6faav2l
SHA256 852caa48db9478a08702a820e821045ebf90360431f512fbc38b82cc055f8cd8
MD5 15d20e3c2d28464b44bcda77eb5fc537
SHA1 3f28329325335406d7e28f9d87ed2d6f11030e13
SHA512 628c2a334a7e2812920d82c5a1188170534d3a4015b683ea8ad5defc98c19611995dfb966e759254b090590d50b262bf949db91f36f90b4ab93b6767f80b0550
SSDEEP 6144:Ncr41EQ5nvvmvb8htoYvLR22edh3JDb0CHHNgD:NoAh+YvLU2uNb0CN0
TLSH
T156648C1AE7B514EDD5379578C9035417EAF27C4607A0EADF27D08EA21F27AA08E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-01_15d20e3c2d28464b44bcda77eb5fc537_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-06-01_15d20e3c2d28464b44bcda77eb5fc537_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 324KB

2026-06-01_15d20e3c2d28464b44bcda77eb5fc537_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 52c2d81b421cbe6dd1f1e4c114028911
SHA256 852caa48db9478a08702a820e821045ebf90360431f512fbc38b82cc055f8cd8
MD5 15d20e3c2d28464b44bcda77eb5fc537
SHA1 3f28329325335406d7e28f9d87ed2d6f11030e13
SHA512 628c2a334a7e2812920d82c5a1188170534d3a4015b683ea8ad5defc98c19611995dfb966e759254b090590d50b262bf949db91f36f90b4ab93b6767f80b0550
SSDEEP 6144:Ncr41EQ5nvvmvb8htoYvLR22edh3JDb0CHHNgD:NoAh+YvLU2uNb0CN0
TLSH
T156648C1AE7B514EDD5379578C9035417EAF27C4607A0EADF27D08EA21F27AA08E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

137852

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualAllocEx GetModuleHandleW WriteConsoleW CreateFileW CloseHandle GetConsoleMode GetConsoleOutputCP QueryPerformanceCounter QueryPerformanceFrequency WideCharToMultiByte InitializeCriticalSectionEx GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId InitializeSListHead GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapReAlloc HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-01_15d20e3c2d28464b44bcda77eb5fc537_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

ntdll

generic