2026-07-05_36c89225232615e028cc717a4bba17b2_cobalt-strike_gazer_helldown_icedid_luca-stealer_njrat_remcos_ryuk

General

Target
2026-07-05_36c89225232615e028cc717a4bba17b2_cobalt-strike_gazer_helldown_icedid_luca-stealer_njrat_remcos_ryuk
Size 3.5MB
Sample260705-dafnvacv6q
SHA256 9768b56b39415211b5581c499c867b51675a486b920aeb88ff349a1d3094d306
MD5 36c89225232615e028cc717a4bba17b2
SHA1 62d9135c31cd218798a3245ab8497615128ffb8d
SHA512 9fd036390180cf1422f0d142e9be7a3b8ce14e606b3874afbaaf2019b5b402e7a8e18c1e0af10da5916dc7587f9452549d0b09f0d4a2cb834979e8efc5967e75
SSDEEP 49152:VCeetZqNHDfbA1ZIFKxKMdUPVS2hIOWyXuV4Sjc7oIciewE+MiDOch1Mu9sWlNau:behZIFKxD2LcscfsOHWlNa6/S6
TLSH
T12606E112A1D101F9C463C278CA8A1A1BF762B80A736D9EDF16C145422F63FE25F7A35D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_36c89225232615e028cc717a4bba17b2_cobalt-strike_gazer_helldown_icedid_luca-stealer_njrat_remcos_ryuk

File Explorer

2026-07-05_36c89225232615e028cc717a4bba17b2_cobalt-strike_gazer_helldown_icedid_luca-stealer_njrat_remcos_ryuk

.exe 3.5MB

2026-07-05_36c89225232615e028cc717a4bba17b2_cobalt-strike_gazer_helldown_icedid_luca-stealer_njrat_remcos_ryuk

IMPHASH 633c999994fa0062226eaf117e8e677f
SHA256 9768b56b39415211b5581c499c867b51675a486b920aeb88ff349a1d3094d306
MD5 36c89225232615e028cc717a4bba17b2
SHA1 62d9135c31cd218798a3245ab8497615128ffb8d
SHA512 9fd036390180cf1422f0d142e9be7a3b8ce14e606b3874afbaaf2019b5b402e7a8e18c1e0af10da5916dc7587f9452549d0b09f0d4a2cb834979e8efc5967e75
SSDEEP 49152:VCeetZqNHDfbA1ZIFKxKMdUPVS2hIOWyXuV4Sjc7oIciewE+MiDOch1Mu9sWlNau:behZIFKxD2LcscfsOHWlNa6/S6
TLSH
T12606E112A1D101F9C463C278CA8A1A1BF762B80A736D9EDF16C145422F63FE25F7A35D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

930376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSAGetLastError WSAStartup __WSAFDIsSet closesocket connect freeaddrinfo getaddrinfo inet_pton ioctlsocket recv select send shutdown socket

kernel32

AreFileApisANSI CloseHandle CompareStringW CreateFile2 CreateFileW CreateProcessW DecodePointer DeleteCriticalSection DeleteFileW EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandleEx GetFileSizeEx GetFileType GetLastError GetLocaleInfoEx GetLocaleInfoW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW LocalFree MoveFileExA MoveFileExW MultiByteToWideChar QueryPerformanceCounter RaiseException ReadConsoleW ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile

bcrypt

BCryptGenRandom

Name

.std

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data0

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

422B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_36c89225232615e028cc717a4bba17b2_cobalt-strike_gazer_helldown_icedid_luca-stealer_njrat_remcos_ryuk

ws2_32

kernel32

bcrypt

generic