2026-07-05_051b631812643a738ff6ea241c2a84c8_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-07-05_051b631812643a738ff6ea241c2a84c8_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 194KB
Sample260705-cebd9acs8n
SHA256 f23ae859a047c252d4aa573cbec35d23fdaca51981c756af1dd133274dfdfb96
MD5 051b631812643a738ff6ea241c2a84c8
SHA1 a0b98ae7000569656978e0829605df058ad44ea3
SHA512 eec705d9b27407a19bd863477abec392498f59b494dd9fdaf06369357e6e47ab09573addf59ac48146a4823b35f45b827f475e9e5ee0ba49aaf0fa1f7f2a3a1b
SSDEEP 3072:bmqoRodhgBSQw9HZ9Ka/PPIam+/6gZY4lJn8T1rGDxlYOkO:/oRod939Z/4at8TUDlkO
TLSH
T138145B19B7A451FAF1B7C538C9914901FB72BC464B70AADF17500BB68E236E09E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing combination of virtualization drivers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_051b631812643a738ff6ea241c2a84c8_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-05_051b631812643a738ff6ea241c2a84c8_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 194KB

2026-07-05_051b631812643a738ff6ea241c2a84c8_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH e49a266356a0fbd17ceb05746337258d
SHA256 f23ae859a047c252d4aa573cbec35d23fdaca51981c756af1dd133274dfdfb96
MD5 051b631812643a738ff6ea241c2a84c8
SHA1 a0b98ae7000569656978e0829605df058ad44ea3
SHA512 eec705d9b27407a19bd863477abec392498f59b494dd9fdaf06369357e6e47ab09573addf59ac48146a4823b35f45b827f475e9e5ee0ba49aaf0fa1f7f2a3a1b
SSDEEP 3072:bmqoRodhgBSQw9HZ9Ka/PPIam+/6gZY4lJn8T1rGDxlYOkO:/oRod939Z/4at8TUDlkO
TLSH
T138145B19B7A451FAF1B7C538C9914901FB72BC464B70AADF17500BB68E236E09E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables referencing combination of virtualization drivers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

28844

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\samta\source\repos\AntiSkid\x64\Release\AntiSkid.pdb

user32

PostMessageW MessageBoxW ShowWindow EnumWindows GetWindowTextW

advapi32

RegOpenKeyExW RegisterServiceCtrlHandlerW RegCloseKey SetServiceStatus StartServiceCtrlDispatcherW

kernel32

HeapReAlloc CreateFileW GetConsoleScreenBufferInfo SetLastError SetConsoleTextAttribute GetCurrentProcess GetStdHandle OutputDebugStringA TerminateProcess WriteConsoleW OpenProcess CreateToolhelp32Snapshot CreateEventW Sleep GetLastError Process32NextW OutputDebugStringW SetEvent GetCurrentThread Process32FirstW CloseHandle GetThreadContext GetProcAddress ExitProcess GetModuleHandleW GetConsoleWindow IsDebuggerPresent CheckRemoteDebuggerPresent HeapSize GetFileAttributesW RtlLookupFunctionEntry QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId InitializeCriticalSectionEx GetSystemTimeAsFileTime WakeAllConditionVariable RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetModuleFileNameW WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetFileType MultiByteToWideChar FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx

iphlpapi

GetAdaptersInfo

Name

.text

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_051b631812643a738ff6ea241c2a84c8_cobalt-strike_icedid_luca-stealer_njrat_stealc

user32

advapi32

kernel32

iphlpapi

generic