2026-07-08_5136c48a5c535219ac0c0cbce7405049_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-07-08_5136c48a5c535219ac0c0cbce7405049_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 327KB
Sample260708-e9vsgsbx2n
SHA256 b27d0c950716999f473efd4b77a631f24c7bb829dc0203234174cd41092e626a
MD5 5136c48a5c535219ac0c0cbce7405049
SHA1 7a86fd3d6a1dabc937c23a668abe2b9c0f18f32d
SHA512 ceeebdc01f6e26c3e2c89a884be534403eb1dc3cca15723abc2bd79370f2894c5e4d5649605bd5be4b99a970e3df320f58da7246e251d96ba2b8353d832558db
SSDEEP 6144:plCdiDIuCU7NXNFxkrqDRE7KlcEp/1RwsR1KO6+N/:pQeXFxCqNE7Oc4KsRlr
TLSH
T150648E1BB7B514BDD1378578D9224407EAF2784547A0B9EF17F09EB21B3BAA0863E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_5136c48a5c535219ac0c0cbce7405049_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-08_5136c48a5c535219ac0c0cbce7405049_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 327KB

2026-07-08_5136c48a5c535219ac0c0cbce7405049_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 2d16eaa5fd845890c10734cfb77d9fd0
SHA256 b27d0c950716999f473efd4b77a631f24c7bb829dc0203234174cd41092e626a
MD5 5136c48a5c535219ac0c0cbce7405049
SHA1 7a86fd3d6a1dabc937c23a668abe2b9c0f18f32d
SHA512 ceeebdc01f6e26c3e2c89a884be534403eb1dc3cca15723abc2bd79370f2894c5e4d5649605bd5be4b99a970e3df320f58da7246e251d96ba2b8353d832558db
SSDEEP 6144:plCdiDIuCU7NXNFxkrqDRE7KlcEp/1RwsR1KO6+N/:pQeXFxCqNE7Oc4KsRlr
TLSH
T150648E1BB7B514BDD1378578D9224407EAF2784547A0B9EF17F09EB21B3BAA0863E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

137644

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualAllocEx GetEnvironmentStringsW GetModuleHandleW WriteConsoleW CreateFileW CloseHandle GetConsoleMode GetConsoleOutputCP QueryPerformanceCounter QueryPerformanceFrequency WideCharToMultiByte InitializeCriticalSectionEx GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId InitializeSListHead GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapReAlloc HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW FreeEnvironmentStringsW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers

user32

MessageBoxA

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-08_5136c48a5c535219ac0c0cbce7405049_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

ntdll

generic