2026-07-05_f3ab6dd01f0d979028e0289a969e35ee_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-07-05_f3ab6dd01f0d979028e0289a969e35ee_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 322KB
Sample260705-l2harafs2k
SHA256 ae943cca220c9d2ea31820a206dab26e2af0bc3928d78f80ed06171ced9ba6dd
MD5 f3ab6dd01f0d979028e0289a969e35ee
SHA1 385b8c98a40154e37d89ec76431d965789ee6da6
SHA512 04d5d3cc7bacc6b41b1d453977223747e7db1a337854e9ff654f0c1caa64192a78a664661bcde284869bc28b77380b6b2dfc77e5b7e7a530ea3d6a72acdc462e
SSDEEP 6144:KlCViTIuCU7NXNFxkrqDRE7KlcEp/1Rws1oKO6qNR:KYeXFxCqNE7Oc4Ks1sP
TLSH
T140648D1BA3B514FDD5B78578C9025607EAF2B8451FA099DF07D08FB23B27AA0863E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-05_f3ab6dd01f0d979028e0289a969e35ee_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-05_f3ab6dd01f0d979028e0289a969e35ee_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 322KB

2026-07-05_f3ab6dd01f0d979028e0289a969e35ee_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 2d16eaa5fd845890c10734cfb77d9fd0
SHA256 ae943cca220c9d2ea31820a206dab26e2af0bc3928d78f80ed06171ced9ba6dd
MD5 f3ab6dd01f0d979028e0289a969e35ee
SHA1 385b8c98a40154e37d89ec76431d965789ee6da6
SHA512 04d5d3cc7bacc6b41b1d453977223747e7db1a337854e9ff654f0c1caa64192a78a664661bcde284869bc28b77380b6b2dfc77e5b7e7a530ea3d6a72acdc462e
SSDEEP 6144:KlCViTIuCU7NXNFxkrqDRE7KlcEp/1Rws1oKO6qNR:KYeXFxCqNE7Oc4Ks1sP
TLSH
T140648D1BA3B514FDD5B78578C9025607EAF2B8451FA099DF07D08FB23B27AA0863E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

137644

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualAllocEx GetEnvironmentStringsW GetModuleHandleW WriteConsoleW CreateFileW CloseHandle GetConsoleMode GetConsoleOutputCP QueryPerformanceCounter QueryPerformanceFrequency WideCharToMultiByte InitializeCriticalSectionEx GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId InitializeSListHead GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapReAlloc HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW FreeEnvironmentStringsW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers

user32

MessageBoxA

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-05_f3ab6dd01f0d979028e0289a969e35ee_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

ntdll

generic