2026-07-02_796dddd0386d5813cc9a95b4dc8fc328_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-02_796dddd0386d5813cc9a95b4dc8fc328_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 867KB
Sample260702-vvy5csfx8p
SHA256 69525610bf4cd62d90ca4e184de6107ac647db5b7d61f534bf48ba7b3a1a877e
MD5 796dddd0386d5813cc9a95b4dc8fc328
SHA1 7590dcf335911cb4253064259d658e0b6eae9003
SHA512 cc0e02d5b5731326bc6697279ec3d64143d1bb3c52e74a2c9179e428527caccf42242520f04e267311ad098d7d217eb921f934be86d44de310ea909eca5babb3
SSDEEP 24576:PCVIntxNI7s5doLPJc/OzDsQAs9qripzwPtfeU:5xNI7s5doLPMfs9qripiGU
TLSH
T18715E005AA9182ABF031883455774B42DF7ABC4C67204A937F9C71BB6F3B7506E2D722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-02_796dddd0386d5813cc9a95b4dc8fc328_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-02_796dddd0386d5813cc9a95b4dc8fc328_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 867KB

2026-07-02_796dddd0386d5813cc9a95b4dc8fc328_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH a165f62f913e63193e3d31c9bc7f7652
SHA256 69525610bf4cd62d90ca4e184de6107ac647db5b7d61f534bf48ba7b3a1a877e
MD5 796dddd0386d5813cc9a95b4dc8fc328
SHA1 7590dcf335911cb4253064259d658e0b6eae9003
SHA512 cc0e02d5b5731326bc6697279ec3d64143d1bb3c52e74a2c9179e428527caccf42242520f04e267311ad098d7d217eb921f934be86d44de310ea909eca5babb3
SSDEEP 24576:PCVIntxNI7s5doLPJc/OzDsQAs9qripzwPtfeU:5xNI7s5doLPMfs9qripiGU
TLSH
T18715E005AA9182ABF031883455774B42DF7ABC4C67204A937F9C71BB6F3B7506E2D722
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\app_compile\pub\bin64\Publish\QyLauncher.pdb

kernel32

K32GetProcessImageFileNameW CloseHandle GetProcAddress GetModuleHandleW GetCurrentProcess FindFirstFileW FindNextFileW FindClose CompareFileTime OutputDebugStringW HeapFree GetLastError HeapSize HeapReAlloc HeapAlloc DeleteCriticalSection GetProcessHeap WriteConsoleW CreateFileW OpenProcess GetCommandLineW WritePrivateProfileStringW InitializeCriticalSectionEx GetPrivateProfileStringW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW IsDebuggerPresent RaiseException EnterCriticalSection LeaveCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle

user32

MessageBoxW

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegDeleteTreeW

shell32

ShellExecuteExW SHGetSpecialFolderPathW

shlwapi

PathFileExistsW PathCombineW

Name

.text

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

581KB

Virtual Size

580KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-02_796dddd0386d5813cc9a95b4dc8fc328_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

advapi32

shell32

shlwapi

generic