2026-06-04_5c12bb49e72219f09b16b8e9e86c9b42_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-04_5c12bb49e72219f09b16b8e9e86c9b42_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 309KB
Sample260604-bzag1sgv4x
SHA256 72f7d41848a367d0b0693ea86c0b2c80a85adbd14ae06f69b28bc44e3586de4a
MD5 5c12bb49e72219f09b16b8e9e86c9b42
SHA1 83b8145bb54e97f35ff7cbd9a321a918f4f8c39f
SHA512 7f115b136c7ba334ea663d9156ce96c06b4b46718d29fcaa6761ddb3f357437563e1a8a750508eb1fd653aa4f85a7633a3eeb10e033ed3bca95645cbd8f55f85
SSDEEP 3072:D4hp4wRSg1zbnHdg9W3S3nh2zor/ARhj/jcqoFh/y/D3Ljeyj09id/lThMdSDfdf:D4hG0EW3S38hzjcqoFh/yjmQKlJrmF
TLSH
T1A5646C16F3A514F9E977917CC9824902EB72BC5647A0E6CF03904AA73F276E05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-06-04_5c12bb49e72219f09b16b8e9e86c9b42_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-06-04_5c12bb49e72219f09b16b8e9e86c9b42_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 309KB

2026-06-04_5c12bb49e72219f09b16b8e9e86c9b42_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 919381ded8615069b5f9177ce7b1aa97
SHA256 72f7d41848a367d0b0693ea86c0b2c80a85adbd14ae06f69b28bc44e3586de4a
MD5 5c12bb49e72219f09b16b8e9e86c9b42
SHA1 83b8145bb54e97f35ff7cbd9a321a918f4f8c39f
SHA512 7f115b136c7ba334ea663d9156ce96c06b4b46718d29fcaa6761ddb3f357437563e1a8a750508eb1fd653aa4f85a7633a3eeb10e033ed3bca95645cbd8f55f85
SSDEEP 3072:D4hp4wRSg1zbnHdg9W3S3nh2zor/ARhj/jcqoFh/y/D3Ljeyj09id/lThMdSDfdf:D4hG0EW3S38hzjcqoFh/yjmQKlJrmF
TLSH
T1A5646C16F3A514F9E977917CC9824902EB72BC5647A0E6CF03904AA73F276E05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

64192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Luxe\Desktop\Miner\Loaderv3\x64\Release\Loader.pdb

kernel32

CreateMutexA WaitForSingleObject ReleaseMutex ResumeThread GetModuleHandleA SetFileAttributesW GetLastError GetFileAttributesA CreateFileA DeleteFileA CloseHandle SetFileAttributesA GetProcAddress ExitProcess CreateProcessW CreateProcessA GetTickCount GetExitCodeProcess WriteProcessMemory Wow64SetThreadContext Wow64GetThreadContext GetThreadContext SetThreadContext CreateFileTransactedW WriteFile WriteConsoleW GetFileSizeEx ReadFile CreateDirectoryW WideCharToMultiByte GetUserGeoID GetSystemPowerStatus HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW CreateFileW GetGeoInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree GetStdHandle GetModuleFileNameW QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive Sleep WaitForSingleObjectEx GetExitCodeThread InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW WakeAllConditionVariable EncodePointer DecodePointer LocalFree EnterCriticalSection LeaveCriticalSection DeleteCriticalSection MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW RtlUnwind

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoUninitialize

oleaut32

VariantClear SysAllocString SysFreeString

dxgi

CreateDXGIFactory

wininet

InternetReadFile InternetCloseHandle InternetOpenW InternetOpenUrlW HttpQueryInfoA InternetOpenUrlA InternetOpenA

winhttp

WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpOpen WinHttpReceiveResponse

crypt32

CryptStringToBinaryA

ktmw32

CreateTransaction RollbackTransaction

ntdll

RtlLookupFunctionEntry RtlCaptureContext NtCreateSection NtMapViewOfSection RtlVirtualUnwind

Name

.text

Size

206KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-04_5c12bb49e72219f09b16b8e9e86c9b42_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

ole32

oleaut32

dxgi

wininet

winhttp

crypt32

ktmw32

ntdll

generic