2026-07-05_911c9b896cc630ba4ed83901b39f1783_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-05_911c9b896cc630ba4ed83901b39f1783_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 405KB
Sample260705-brkm1sbx7m
SHA256 d73448ad9868287678b2122ab26d53d7581393a94e28fa10dacd67c1655dc28d
MD5 911c9b896cc630ba4ed83901b39f1783
SHA1 cb0395e542cff4d0613f0b21622400764c649f98
SHA512 5080c7b1620bcf75a7756cc5f78782c6a5575aaf54912291d8ce57df69f309bfb2f934acd3bd43e0104f16c86e97d566b55b445c45dcaaaa5d45956149d77b2f
SSDEEP 6144:iitQYEaXN8POTCPDF30DOvpLAYB2Erj1em25mK3Lgs3xn6or/wXD:eYlOnPDF3nvpkizeLio
TLSH
T184946D29E7B424BCE177D178CE475902EAB2785A03E195EF03D08AB21E375F05A3E716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_911c9b896cc630ba4ed83901b39f1783_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-05_911c9b896cc630ba4ed83901b39f1783_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 405KB

2026-07-05_911c9b896cc630ba4ed83901b39f1783_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 469e999eeea04194eb7f5ed34cd2e8bf
SHA256 d73448ad9868287678b2122ab26d53d7581393a94e28fa10dacd67c1655dc28d
MD5 911c9b896cc630ba4ed83901b39f1783
SHA1 cb0395e542cff4d0613f0b21622400764c649f98
SHA512 5080c7b1620bcf75a7756cc5f78782c6a5575aaf54912291d8ce57df69f309bfb2f934acd3bd43e0104f16c86e97d566b55b445c45dcaaaa5d45956149d77b2f
SSDEEP 6144:iitQYEaXN8POTCPDF30DOvpLAYB2Erj1em25mK3Lgs3xn6or/wXD:eYlOnPDF3nvpkizeLio
TLSH
T184946D29E7B424BCE177D178CE475902EAB2785A03E195EF03D08AB21E375F05A3E716
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables embedding registry key / value combination indicative of disabling Windows Defen
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

145776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

closesocket connect ioctlsocket getsockname getsockopt htons ntohs inet_ntop inet_pton WSAIoctl WSAGetLastError WSACleanup WSAStartup socket setsockopt send select recv __WSAFDIsSet

gdi32

SelectObject GetDIBits DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt DeleteObject

user32

TranslateMessage CloseClipboard GetClipboardData PeekMessageA OpenClipboard DispatchMessageA GetKeyboardState CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetCursorPos ReleaseDC GetDC GetSystemMetrics MapVirtualKeyA ToUnicode

advapi32

CloseEventLog AllocateAndInitializeSid FreeSid GetTokenInformation CredFree CredEnumerateW SetNamedSecurityInfoA SetEntriesInAclA QueryServiceStatus OpenServiceA OpenSCManagerA ControlService CloseServiceHandle ChangeServiceConfigA RegSetValueExA RegQueryValueExA RegOpenKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA ClearEventLogA OpenEventLogA GetUserNameA RegCloseKey OpenProcessToken

shell32

ShellExecuteExA

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeEx CoUninitialize CoTaskMemFree

oleaut32

SysAllocString VariantClear VariantInit SysFreeString

mf

MFEnumDeviceSources

mfplat

MFCreateMediaType MFStartup MFCreateAttributes MFShutdown

mfreadwrite

MFCreateSourceReaderFromMediaSource

iphlpapi

GetAdaptersAddresses GetExtendedTcpTable

kernel32

FlsFree FlsSetValue FlsGetValue FlsAlloc LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx HeapReAlloc HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileType GetModuleFileNameW GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader GetCPInfo GetStringTypeW CreateFileW WriteConsoleW OpenProcess GetEnvironmentVariableA SetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA FindClose FindFirstFileA FindNextFileA GetDiskFreeSpaceExA GetFileAttributesA GetFileSize GetFileSizeEx GetFileTime ReadFile RemoveDirectoryA SetFileTime WriteFile IsDebuggerPresent CloseHandle SetHandleInformation GetLastError CreatePipe HeapAlloc HeapFree GetProcessHeap ReleaseMutex WaitForSingleObject CreateMutexA Sleep GetCurrentProcess GetCurrentProcessId ExitProcess TerminateProcess CreateProcessA InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GlobalMemoryStatusEx GetSystemTime GetTickCount64 VirtualAlloc VirtualProtect GetModuleFileNameA GetModuleHandleA GetProcAddress LoadLibraryA GlobalUnlock GlobalLock LocalFree OpenMutexA CopyFileA MoveFileA MoveFileExA GetComputerNameA FileTimeToSystemTime WideCharToMultiByte CreateToolhelp32Snapshot Process32First Process32Next K32GetProcessMemoryInfo QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW MultiByteToWideChar ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx

Name

.text

Size

276KB

Virtual Size

280KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

107KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_911c9b896cc630ba4ed83901b39f1783_cobalt-strike_icedid_luca-stealer_njrat_stealc

ws2_32

gdi32

user32

advapi32

shell32

ole32

oleaut32

mf

mfplat

mfreadwrite

iphlpapi

kernel32

generic