2026-07-14_6a56c736534c8fcc600da4f8d352972c_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-07-14_6a56c736534c8fcc600da4f8d352972c_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 327KB
Sample260714-ebsv8sfz6t
SHA256 302f768c011f65a783dd91e5cd21e085dde44a779d3b8d9938de1fd7f1209110
MD5 6a56c736534c8fcc600da4f8d352972c
SHA1 443a33b9b69c0fa558d41920852fd8c98023f0b8
SHA512 92e92ae5f8795b78faf14797a4307dce585186f1ba773387f9424ac3796c03879ae52b6df60009bfc391998c76e031a7d5f67e7946a3ba5a1e969c176a1a42e1
SSDEEP 6144:0CNzKfKXTXYZ0HmgUG0IUYiasr489SVNsN2Q:0+TMjgUGhU/c89SfY
TLSH
T1DA648D5AE6B515BED13B8578CD035D07FAF2784607A09ADF17D08BB21B37AA0863E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-14_6a56c736534c8fcc600da4f8d352972c_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-14_6a56c736534c8fcc600da4f8d352972c_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 327KB

2026-07-14_6a56c736534c8fcc600da4f8d352972c_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 229819716c623b799814d2f0eb2a6549
SHA256 302f768c011f65a783dd91e5cd21e085dde44a779d3b8d9938de1fd7f1209110
MD5 6a56c736534c8fcc600da4f8d352972c
SHA1 443a33b9b69c0fa558d41920852fd8c98023f0b8
SHA512 92e92ae5f8795b78faf14797a4307dce585186f1ba773387f9424ac3796c03879ae52b6df60009bfc391998c76e031a7d5f67e7946a3ba5a1e969c176a1a42e1
SSDEEP 6144:0CNzKfKXTXYZ0HmgUG0IUYiasr489SVNsN2Q:0+TMjgUGhU/c89SfY
TLSH
T1DA648D5AE6B515BED13B8578CD035D07FAF2784607A09ADF17D08BB21B37AA0863E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

137260

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualAllocEx GetEnvironmentStringsW GetModuleHandleW WriteConsoleW CreateFileW CloseHandle GetConsoleMode GetConsoleOutputCP FlushFileBuffers QueryPerformanceCounter QueryPerformanceFrequency WideCharToMultiByte InitializeCriticalSectionEx GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId InitializeSListHead GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapReAlloc HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW FreeEnvironmentStringsW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize

user32

MessageBoxW

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-14_6a56c736534c8fcc600da4f8d352972c_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

ntdll

generic