2026-06-30_79bbc8b6e4b03033422aad1b96484624_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-30_79bbc8b6e4b03033422aad1b96484624_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 788KB
Sample260701-evcncsf15z
SHA256 efa9e9e5ea4bd9cb88cba7d9a96cc6fa723dbe55cb5f8ad37df5f413fd0cfe1f
MD5 79bbc8b6e4b03033422aad1b96484624
SHA1 738e274f572f8d4070024fe536e3bf4a71895892
SHA512 2b3856c1268909f7e27f7f542f78f94ebb0f753f96d8abad4237bded13b18ac95335bc4ff6e59603bc7691d7227f40cf0dac509a2ceef7c10272e24219f5c7a0
SSDEEP 24576:hTUqcVJ1netCxuuwG/2lTkreh0lhSMXl9H2:hTUqcVJ1nICxuuwG/Usp
TLSH
T14105ADA5B7D640E8D236C17AC9224709F6B3B865172163CF0350829AEF77AD92D3F742
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-06-30_79bbc8b6e4b03033422aad1b96484624_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 788KB

2026-06-30_79bbc8b6e4b03033422aad1b96484624_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 7bddf788be631c4fc6142dc3afd6ad51
SHA256 efa9e9e5ea4bd9cb88cba7d9a96cc6fa723dbe55cb5f8ad37df5f413fd0cfe1f
MD5 79bbc8b6e4b03033422aad1b96484624
SHA1 738e274f572f8d4070024fe536e3bf4a71895892
SHA512 2b3856c1268909f7e27f7f542f78f94ebb0f753f96d8abad4237bded13b18ac95335bc4ff6e59603bc7691d7227f40cf0dac509a2ceef7c10272e24219f5c7a0
SSDEEP 24576:hTUqcVJ1netCxuuwG/2lTkreh0lhSMXl9H2:hTUqcVJ1nICxuuwG/Usp
TLSH
T14105ADA5B7D640E8D236C17AC9224709F6B3B865172163CF0350829AEF77AD92D3F742
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

76:56:0a:45:75:12:92:ae:89:33:ea:0a:59:9d:8b:83:36:75:05:c9:1f:f7:1e:55:19:f0:3e:c7:46:cb:57:bb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 30, 2025

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

76:56:0a:45:75:12:92:ae:89:33:ea:0a:59:9d:8b:83:36:75:05:c9:1f:f7:1e:55:19:f0:3e:c7:46:cb:57:bb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 29, 2025

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:6e:12:29:85:6f:0a:de:6c:fc:00:00:00:00:00:6e

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 10, 2024 - Oct 8, 2025

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 15, 2014 - Oct 15, 2029

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:591A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:f4:17:46:85:c0:cb:3f:39:e5:00:01:00:00:01:f4

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2024 - Oct 22, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:25:f3:1c:b5:55:76:73:40:d6:00:00:00:00:01:25

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 20, 2025 - Feb 18, 2026

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0b:aa:c1:00:00:00:00:00:09

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:0a:47:b2:14:d9:ee:b2:b3:0f:00:01:00:00:02:0a

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 30, 2025 - Apr 22, 2026

Minor OS version

Major OS version

Entry point

245180

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Projects\SoundEdge\APO\SNAPOSystemService\x64\Release\SNAPOSS64.exe.pdb

rpcrt4

RpcServerUseProtseqEpW RpcServerInqBindings NdrServerCall2 RpcServerListen NdrServerCallAll RpcBindingVectorFree

kernel32

CloseHandle WaitForSingleObject IsWow64Process GetWindowsDirectoryW GetProcessId FlsAlloc LocalAlloc GetCurrentProcess Sleep WriteConsoleW GetLastError CreateThreadpoolWork SubmitThreadpoolWork GetTickCount64 LocalFree CreateEventW SetEvent FlsGetValue CreateThread ResumeThread GetCurrentThreadId GetModuleHandleW HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx SetStdHandle OutputDebugStringW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW RtlUnwind GetEnvironmentStringsW GetFileType GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW WaitForMultipleObjects CompareStringW GetCurrentThread InitializeCriticalSectionEx CreateNamedPipeA GetModuleFileNameW CancelIoEx GetOverlappedResult ResetEvent ConnectNamedPipe DisconnectNamedPipe ReadFile WriteFile FlsSetValue HeapSize WTSGetActiveConsoleSessionId LoadLibraryW GetProcAddress FormatMessageA FreeLibrary CreateProcessW VirtualProtect SetLastError ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead TryAcquireSRWLockExclusive MultiByteToWideChar HeapAlloc WideCharToMultiByte GetStringTypeW WaitForSingleObjectEx GetExitCodeThread CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx GetLocaleInfoEx QueryPerformanceFrequency WakeConditionVariable EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection LCMapStringEx GetCPInfo RtlUnwindEx RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW ExitThread FreeLibraryAndExitThread GetStdHandle GetCommandLineA GetCommandLineW HeapFree FlsFree

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

advapi32

CreateProcessAsUserW OpenProcessToken FreeSid CreateServiceW EventWriteString SetServiceStatus EventUnregister EventRegister RegisterServiceCtrlHandlerExW OpenSCManagerW OpenServiceW ControlService StartServiceCtrlDispatcherW QueryServiceStatus GetTokenInformation SetSecurityDescriptorDacl DeleteService CloseServiceHandle InitializeSecurityDescriptor GetSecurityInfo SetEntriesInAclW SetSecurityInfo RegCloseKey AllocateAndInitializeSid EqualSid

ole32

CoUninitialize CoCreateInstance CoCreateGuid CoInitializeEx PropVariantClear

user32

DefWindowProcW PostQuitMessage SetWindowLongPtrW DispatchMessageW TranslateMessage GetMessageW CreateWindowExW RegisterClassW GetClassInfoW PostMessageW GetWindowLongPtrW

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

Name

.text

Size

413KB

Virtual Size

412KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

240KB

Virtual Size

240KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

73KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-30_79bbc8b6e4b03033422aad1b96484624_cobalt-strike_icedid_luca-stealer_njrat_stealc

rpcrt4

kernel32

version

advapi32

ole32

user32

wtsapi32

userenv

generic