2026-07-05_f17d693f06862bf3c58ac761b7e37ca3_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_f17d693f06862bf3c58ac761b7e37ca3_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc
Size 434KB
Sample260705-behb5afx9s
SHA256 c9dfa113d677658be513407764d891c975364c7398ec9c8f8f3d97d2c5a11b43
MD5 f17d693f06862bf3c58ac761b7e37ca3
SHA1 614964cac602bd203739613d7d4f496d656a982e
SHA512 414ec59a17b87f1cb28aad0cc52ac0e33b2667109908ce6a916e303f3db79508259f8ea4961c7f728d7d75c2016e699f6c8511515ff67c41cc599b7489021848
SSDEEP 6144:Pb1jYVRirQaY036jZiHRJW9c000LrlAGfELKnu9E4CKfMI2VOlzMkhG:Pb1SYrQve8ELKnu6PKkI2kmk
TLSH
T114948E5AE76414F8E1A7C178C9434D06EBB27C464771E78F03E88AB61F276A05E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_f17d693f06862bf3c58ac761b7e37ca3_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-05_f17d693f06862bf3c58ac761b7e37ca3_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc

.exe 434KB

2026-07-05_f17d693f06862bf3c58ac761b7e37ca3_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc

IMPHASH 4741f43393fed9f5cece171dae46204c
SHA256 c9dfa113d677658be513407764d891c975364c7398ec9c8f8f3d97d2c5a11b43
MD5 f17d693f06862bf3c58ac761b7e37ca3
SHA1 614964cac602bd203739613d7d4f496d656a982e
SHA512 414ec59a17b87f1cb28aad0cc52ac0e33b2667109908ce6a916e303f3db79508259f8ea4961c7f728d7d75c2016e699f6c8511515ff67c41cc599b7489021848
SSDEEP 6144:Pb1jYVRirQaY036jZiHRJW9c000LrlAGfELKnu9E4CKfMI2VOlzMkhG:Pb1SYrQve8ELKnu6PKkI2kmk
TLSH
T114948E5AE76414F8E1A7C178C9434D06EBB27C464771E78F03E88AB61F276A05E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

167360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

shlwapi

PathIsDirectoryW wnsprintfW PathFileExistsW

kernel32

MoveFileW FindFirstFileExW GetFileAttributesW GetLastError GetLogicalDrives Sleep SetEndOfFile SetFileAttributesW SetFilePointerEx FlushFileBuffers HeapFree GetCurrentProcess GetModuleFileNameW GetVolumeNameForVolumeMountPointA GetSystemInfo GetWindowsDirectoryA GetProcessHeap GetComputerNameA LocalFree GetSystemTimeAsFileTime WaitForSingleObject CreateEventW SetEvent CloseHandle GetModuleHandleW TerminateProcess OpenProcess QueryDosDeviceW GetCurrentProcessId GetWindowsDirectoryW OutputDebugStringW MultiByteToWideChar WideCharToMultiByte ExitThread HeapAlloc HeapSize SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale DeleteFileW GetFileAttributesExW CreateFileW FindClose WriteFile FindNextFileW GetFileSizeEx FindFirstFileW ReadFile RtlUnwind CreateDirectoryW WriteConsoleW FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue CreateThread FlsGetValue FlsAlloc GetFileType GetCommandLineW GetCommandLineA LoadLibraryExW FreeLibrary TlsFree GetStringTypeW WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive RtlPcToFileHeader RaiseException QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx SwitchToThread GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetProcAddress GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue ExitProcess

iphlpapi

GetAdaptersAddresses

ntdll

NtSetEvent NtCreateEvent NtWaitForSingleObject RtlCreateUserThread NtTerminateThread RtlGetVersion NtClearEvent NtDuplicateObject NtClose NtOpenProcess NtQueryInformationProcess NtQuerySystemInformation NtQueryObject

advapi32

QueryServiceConfigW CloseServiceHandle OpenSCManagerW DeleteService ControlService EnumDependentServicesW EnumServicesStatusExW OpenServiceW QueryServiceStatusEx LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid SetEntriesInAclW SetNamedSecurityInfoW FreeSid RegCloseKey RegGetValueA RegQueryValueExA OpenProcessToken RegOpenKeyExA GetTokenInformation

shell32

SHGetFolderPathW

Name

.text

Size

300KB

Virtual Size

299KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

105KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_f17d693f06862bf3c58ac761b7e37ca3_cobalt-strike_coinminer_icedid_luca-stealer_njrat_stealc

shlwapi

kernel32

iphlpapi

ntdll

advapi32

shell32

generic