2026-07-04_30594193cf923b22d897c26f4cdacc35_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-07-04_30594193cf923b22d897c26f4cdacc35_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 327KB
Sample260704-mp84daet7x
SHA256 4ec060aaba2bf94d5c70f20c47ab9ced3d78a69261cc397fd337a45012c9d867
MD5 30594193cf923b22d897c26f4cdacc35
SHA1 d0983b1d087d7b1824baec4cd971feb814c02bb3
SHA512 aa82883ba5cf6c43bcfe2b67c870dc13daf4abe847c966d8929f4cfbb16a8ccdbd82f093757012d3abc461762a39be7b0d492760018d54a755d0f5652f854e40
SSDEEP 6144:plCViTIuCU7NXNFxkrqDRE7KlcEp/1RwsQ3wdKO6jNC:pYeXFxCqNE7Oc4KsQ3w9y
TLSH
T12A648D19B7B51CBED1BB8578C9524407EBF2784507A0ABDF17D18EA21F37AA0863E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-04_30594193cf923b22d897c26f4cdacc35_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-04_30594193cf923b22d897c26f4cdacc35_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 327KB

2026-07-04_30594193cf923b22d897c26f4cdacc35_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 2d16eaa5fd845890c10734cfb77d9fd0
SHA256 4ec060aaba2bf94d5c70f20c47ab9ced3d78a69261cc397fd337a45012c9d867
MD5 30594193cf923b22d897c26f4cdacc35
SHA1 d0983b1d087d7b1824baec4cd971feb814c02bb3
SHA512 aa82883ba5cf6c43bcfe2b67c870dc13daf4abe847c966d8929f4cfbb16a8ccdbd82f093757012d3abc461762a39be7b0d492760018d54a755d0f5652f854e40
SSDEEP 6144:plCViTIuCU7NXNFxkrqDRE7KlcEp/1RwsQ3wdKO6jNC:pYeXFxCqNE7Oc4KsQ3w9y
TLSH
T12A648D19B7B51CBED1BB8578C9524407EBF2784507A0ABDF17D18EA21F37AA0863E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

137644

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualAllocEx GetEnvironmentStringsW GetModuleHandleW WriteConsoleW CreateFileW CloseHandle GetConsoleMode GetConsoleOutputCP QueryPerformanceCounter QueryPerformanceFrequency WideCharToMultiByte InitializeCriticalSectionEx GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId InitializeSListHead GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapReAlloc HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW FreeEnvironmentStringsW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers

user32

MessageBoxA

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-04_30594193cf923b22d897c26f4cdacc35_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

ntdll

generic