2026-07-06_23eb3df7d6edf0ea28dc4594f2a0673b_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-06_23eb3df7d6edf0ea28dc4594f2a0673b_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 670KB
Sample260706-st1kpahs2w
SHA256 366b4c0fe5253b14890ec27acc36f1392f6738d1b3a87bfa4023d345c53216c1
MD5 23eb3df7d6edf0ea28dc4594f2a0673b
SHA1 cad7b115c4600eab011cd03c1e071ddf0255cec3
SHA512 3a267ef211fa69e40ce4aee240d2129651131af3d57f5b993c943c6018c691f142c0d3be1f646a4b95e271d6572bcb3dc5983a5c6d3cec57902e13eda675610c
SSDEEP 6144:f/8Ix/bQ0HPeC8EV8X+xgjS9UvmZ476lsHuhwziNEfWvcKBhOhxS+rKmOKMEvwNf:38abXHLTIS+t2EUT4lqM9oYongu
TLSH
T18EE48E5EE99621ECE0ABC075C9AD5527F7B13C1D035095EB07D0AE662E33BD05B3AB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-06_23eb3df7d6edf0ea28dc4594f2a0673b_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-06_23eb3df7d6edf0ea28dc4594f2a0673b_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 670KB

2026-07-06_23eb3df7d6edf0ea28dc4594f2a0673b_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 7bf1f951f0c53d0a422462ea578e9bbd
SHA256 366b4c0fe5253b14890ec27acc36f1392f6738d1b3a87bfa4023d345c53216c1
MD5 23eb3df7d6edf0ea28dc4594f2a0673b
SHA1 cad7b115c4600eab011cd03c1e071ddf0255cec3
SHA512 3a267ef211fa69e40ce4aee240d2129651131af3d57f5b993c943c6018c691f142c0d3be1f646a4b95e271d6572bcb3dc5983a5c6d3cec57902e13eda675610c
SSDEEP 6144:f/8Ix/bQ0HPeC8EV8X+xgjS9UvmZ476lsHuhwziNEfWvcKBhOhxS+rKmOKMEvwNf:38abXHLTIS+t2EUT4lqM9oYongu
TLSH
T18EE48E5EE99621ECE0ABC075C9AD5527F7B13C1D035095EB07D0AE662E33BD05B3AB02
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

408912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileA DeleteFileA Process32Next Process32FirstW CloseHandle CreateThread SetFilePointerEx RemoveDirectoryA CreateProcessA GetTickCount GetLogicalDrives SetHandleInformation DeviceIoControl GetDriveTypeA GetSystemTimes CreatePipe GetTickCount64 GetLogicalProcessorInformation GetSystemInfo GlobalMemoryStatusEx WideCharToMultiByte GetDiskFreeSpaceExA GetSystemFirmwareTable GetComputerNameExA QueryFullProcessImageNameA GetStdHandle PeekNamedPipe GetCurrentProcessId GetExitCodeProcess WriteConsoleW CreateFileW HeapReAlloc HeapSize MoveFileExA Process32NextW GetFileAttributesA GetLastError Sleep CreateToolhelp32Snapshot OpenProcess GetCurrentDirectoryA WaitForSingleObject CreateMutexA FindClose FindNextFileA TerminateProcess WriteFile FindFirstFileA GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP Process32First GetFileSizeEx GetModuleFileNameA ReadFile ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeConditionVariable SleepConditionVariableCS SetThreadPriority RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW FindFirstFileExW FindNextFileW IsValidCodePage GetACP

user32

GetDC ReleaseDC GetSystemMetrics

gdi32

DeleteDC SetStretchBltMode BitBlt GdiFlush SetBrushOrgEx DeleteObject SelectObject CreateDIBSection CreateCompatibleDC StretchBlt

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

shell32

ShellExecuteA

ws2_32

socket WSAStartup recv htons setsockopt inet_pton closesocket send inet_ntop connect

dxgi

CreateDXGIFactory1

iphlpapi

GetIfTable2 GetAdaptersAddresses FreeMibTable

Name

.text

Size

509KB

Virtual Size

509KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

131KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-06_23eb3df7d6edf0ea28dc4594f2a0673b_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

gdi32

advapi32

shell32

ws2_32

dxgi

iphlpapi

generic