2026-07-02_d062814507ccc3aef552c7ac29b28df0_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-07-02_d062814507ccc3aef552c7ac29b28df0_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 169KB
Sample260702-kl9jmac14k
SHA256 9b9e6cc0ce89dd8c55660e5b2165213700c23293efe78e72b3ecb807d1f71b01
MD5 d062814507ccc3aef552c7ac29b28df0
SHA1 c53cd0d1ea630ac6800e38b80ac0aaf4fc225bd9
SHA512 6e37ff89d9fc6a9f5da668e897db3d7cc4ac6fd2ed97a284e1ba028eaac23aa105e457bd5f6825e60ca98189dcaf5d50f6254839a5f6362fab7e77d2927a9c05
SSDEEP 3072:H9TXfv6J6085r017jd9PPY2GwGlUG2KXcyZL6t:H9eQ08GjTY2ucoL
TLSH
T110048E56B3A511F9E1B78239C9521606FBB278250B709BDF07A08375AF237D05E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_d062814507ccc3aef552c7ac29b28df0_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-02_d062814507ccc3aef552c7ac29b28df0_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 169KB

2026-07-02_d062814507ccc3aef552c7ac29b28df0_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH f5f9ab18b54005c1a71c4c7ef483d1cc
SHA256 9b9e6cc0ce89dd8c55660e5b2165213700c23293efe78e72b3ecb807d1f71b01
MD5 d062814507ccc3aef552c7ac29b28df0
SHA1 c53cd0d1ea630ac6800e38b80ac0aaf4fc225bd9
SHA512 6e37ff89d9fc6a9f5da668e897db3d7cc4ac6fd2ed97a284e1ba028eaac23aa105e457bd5f6825e60ca98189dcaf5d50f6254839a5f6362fab7e77d2927a9c05
SSDEEP 3072:H9TXfv6J6085r017jd9PPY2GwGlUG2KXcyZL6t:H9eQ08GjTY2ucoL
TLSH
T110048E56B3A511F9E1B78239C9521606FBB278250B709BDF07A08375AF237D05E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

12276

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\dev\pocs\hook\bin\Release\injector.pdb

kernel32

ReadFile GetFileSizeEx GetCurrentProcess CreateFileW CloseHandle GetCurrentProcessId VirtualProtect VirtualFree VirtualAlloc WriteConsoleW HeapReAlloc HeapSize QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

user32

EnumWindows GetWindowThreadProcessId

Name

.text

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_d062814507ccc3aef552c7ac29b28df0_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

generic