2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 397KB
Sample260705-3d871ab15m
SHA256 4b32770f025cc3e95862a3df2d5bd48fcda624ef25c5c59aeb9851b55f5eca07
MD5 5f14fd8b770e43b446e7499a37b9114e
SHA1 0c0c0647f17f21f577f3997524561ff2a96ee1ae
SHA512 279538618c715bfc0cc302022b0c1a58ab4b25652c21ae8cc69242f76d88bd7c017489394422a07145bd1f467517a35b0f21c8c22753b59da195b171f1303721
SSDEEP 6144:rStAqUBm3NSnTMKLWdpi9kbS4u2zbHOLFKVH2v46EHC:rSCqUBVMwt47LPuwstEH
TLSH
T1FB848D69FAA400F9D1A7D53CCD524502EA727C9E47B0DADF13E84A621F276E04E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 397KB

2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 2b83086df0e8b60fca743f9e78161a24
SHA256 4b32770f025cc3e95862a3df2d5bd48fcda624ef25c5c59aeb9851b55f5eca07
MD5 5f14fd8b770e43b446e7499a37b9114e
SHA1 0c0c0647f17f21f577f3997524561ff2a96ee1ae
SHA512 279538618c715bfc0cc302022b0c1a58ab4b25652c21ae8cc69242f76d88bd7c017489394422a07145bd1f467517a35b0f21c8c22753b59da195b171f1303721
SSDEEP 6144:rStAqUBm3NSnTMKLWdpi9kbS4u2zbHOLFKVH2v46EHC:rSCqUBVMwt47LPuwstEH
TLSH
T1FB848D69FAA400F9D1A7D53CCD524502EA727C9E47B0DADF13E84A621F276E04E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

111168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

urlmon

URLDownloadToFileW

wintrust

WinVerifyTrust

crypt32

CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertCompareCertificateName CryptQueryObject CertEnumCertificatesInStore CertFreeCertificateContext CryptMsgClose CertCloseStore

advapi32

RegEnumKeyA RegCloseKey QueryServiceStatus RegOpenKeyExA RegEnumValueA OpenServiceA CloseServiceHandle OpenSCManagerA

kernel32

WriteConsoleW SetEndOfFile UnhandledExceptionFilter HeapSize ReadFile Process32First SetConsoleTextAttribute GetStdHandle CreatePipe QueryDosDeviceA WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetTempPathA GetModuleHandleExA GetTickCount64 GetFileAttributesA QueryFullProcessImageNameA FileTimeToSystemTime LoadLibraryA DeleteFileA Process32Next CloseHandle FileTimeToLocalFileTime GetProcAddress ReadProcessMemory SystemTimeToFileTime GetConsoleWindow CreateProcessA GetSystemTimeAsFileTime CreateDirectoryA GetTickCount GetProcessTimes VirtualQueryEx CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnwind SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree HeapAlloc GetExitCodeProcess CreateProcessW GetFileAttributesExW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage

user32

GetClassNameA GetWindowTextA GetWindowLongA SetWindowTextA GetWindowThreadProcessId EnumWindows

Name

.text

Size

277KB

Virtual Size

277KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_5f14fd8b770e43b446e7499a37b9114e_cobalt-strike_icedid_luca-stealer_njrat_stealc

urlmon

wintrust

crypt32

advapi32

kernel32

user32

generic