2026-06-02_b1978b5f1498e4ec7c9b7d7b39f163ee_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-02_b1978b5f1498e4ec7c9b7d7b39f163ee_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 900KB
Sample260602-lr4e8sat4z
SHA256 67f393c0c0677fd395e7f2d630fd059c78bae4c7e280ec9ffd8f7460e9055bd7
MD5 b1978b5f1498e4ec7c9b7d7b39f163ee
SHA1 bdd58e72e826ea915b7ca4990b1e3006dc181fb1
SHA512 eeab4cd9aeb2d58182530be379a9a8c69508f0061e979919ee0717a941e2fc8acfd934552085316b3e9f8be4b7c0b38eff86e7bab8967a2ed020a8d0f27f8edb
SSDEEP 12288:4hZ5H2ggb3067PrTcmD1WOuZW/o1kgZzVfRFgXmkR+EiioDvHOl2:W/DOzPsmD7CW/oWSZfRa1JiioGl2
TLSH
T191159D05E55853BBC59A41B78AD1336BC261FCA40379CAF723E03F681B469E45BB1B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-02_b1978b5f1498e4ec7c9b7d7b39f163ee_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-06-02_b1978b5f1498e4ec7c9b7d7b39f163ee_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 900KB

2026-06-02_b1978b5f1498e4ec7c9b7d7b39f163ee_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 0ae435ff535d24cefe999d508f9492c2
SHA256 67f393c0c0677fd395e7f2d630fd059c78bae4c7e280ec9ffd8f7460e9055bd7
MD5 b1978b5f1498e4ec7c9b7d7b39f163ee
SHA1 bdd58e72e826ea915b7ca4990b1e3006dc181fb1
SHA512 eeab4cd9aeb2d58182530be379a9a8c69508f0061e979919ee0717a941e2fc8acfd934552085316b3e9f8be4b7c0b38eff86e7bab8967a2ed020a8d0f27f8edb
SSDEEP 12288:4hZ5H2ggb3067PrTcmD1WOuZW/o1kgZzVfRFgXmkR+EiioDvHOl2:W/DOzPsmD7CW/oWSZfRa1JiioGl2
TLSH
T191159D05E55853BBC59A41B78AD1336BC261FCA40379CAF723E03F681B469E45BB1B0B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

482548

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReadData WinHttpReceiveResponse WinHttpSetOption WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpConnect WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpen

advapi32

OpenSCManagerW OpenServiceW ConvertStringSecurityDescriptorToSecurityDescriptorW QueryServiceConfigW StartServiceW ControlService StartServiceCtrlDispatcherW CloseServiceHandle ChangeServiceConfigW SetServiceStatus RegisterServiceCtrlHandlerW

kernel32

SetEnvironmentVariableW GetProcessHeap IsValidCodePage FindNextFileW FindFirstFileExW HeapReAlloc WriteFile CreateFileA CloseHandle CreateThread ReadFile FindFirstFileA SetConsoleTextAttribute GetStdHandle TerminateProcess GetModuleFileNameW CreateNamedPipeW FindNextFileA CreatePipe ExpandEnvironmentStringsA FindClose WaitForSingleObject CreateFileW DisconnectNamedPipe OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW Process32FirstW GetFileSize GetCurrentProcessId CreateProcessA ConnectNamedPipe GetExitCodeProcess GetLogicalDrives GetConsoleScreenBufferInfo SetConsoleTitleA GetCurrentProcess GetEnvironmentVariableW GetCurrentThreadId FreeConsole GetLocalTime GetThreadContext GetProcAddress ExitProcess GetModuleHandleW GetConsoleWindow SetConsoleCursorPosition GetTickCount AllocConsole GetDriveTypeW OpenThread IsDebuggerPresent CheckRemoteDebuggerPresent MultiByteToWideChar SetStdHandle WideCharToMultiByte FreeEnvironmentStringsW QueryPerformanceCounter PeekConsoleInputA ReadConsoleInputW GetNumberOfConsoleInputEvents SetConsoleMode ReadConsoleW GetFileAttributesExW CreateProcessW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation GetFileType SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetConsoleCP GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx HeapSize WriteConsoleW RtlUnwind GetEnvironmentStringsW InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW GetCommandLineW GetCommandLineA GetOEMCP FreeLibrary GetACP SetEndOfFile ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime

user32

GetSystemMenu DeleteMenu EnumDisplayDevicesA

bcrypt

BCryptHashData BCryptGenerateSymmetricKey BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptFinishHash BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDecrypt BCryptSetProperty BCryptGetProperty BCryptDestroyKey BCryptEncrypt BCryptCreateHash

Name

.text

Size

651KB

Virtual Size

650KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

194KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

648B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-02_b1978b5f1498e4ec7c9b7d7b39f163ee_cobalt-strike_icedid_luca-stealer_njrat_stealc

winhttp

advapi32

kernel32

user32

bcrypt

generic