2026-07-17_25d483ea48e35b4a5ee4e9eb0c0f046a_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-07-17_25d483ea48e35b4a5ee4e9eb0c0f046a_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 160KB
Sample260718-e57lgsgv3j
SHA256 b2856781ef8a57ce337eead61ec16421bf5cf64169c4c6cf48e35118f6c84c63
MD5 25d483ea48e35b4a5ee4e9eb0c0f046a
SHA1 20ee833a57c1eba323cd0fc047e9091b89b22537
SHA512 01144c3c1e2c519028dd618608438bb1d2db05db6184869b0db0808d99dc1248a0b092e5c6fffedfefd54bd9b3abd7fe0efb58743de936fd58da1102ac2305a3
SSDEEP 3072:zpIKvJGYiHjLc0KXfxYZtpD9tvAz7G6EngK/ZH5lS:d3wLZKXKez7dJizS
TLSH
T11BF3385BB2A120F5D0B7C53889611A0AFBB2747283609BDF579446B61F337E09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-17_25d483ea48e35b4a5ee4e9eb0c0f046a_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-17_25d483ea48e35b4a5ee4e9eb0c0f046a_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 160KB

2026-07-17_25d483ea48e35b4a5ee4e9eb0c0f046a_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 5b81003307fc5b0183facc321350458b
SHA256 b2856781ef8a57ce337eead61ec16421bf5cf64169c4c6cf48e35118f6c84c63
MD5 25d483ea48e35b4a5ee4e9eb0c0f046a
SHA1 20ee833a57c1eba323cd0fc047e9091b89b22537
SHA512 01144c3c1e2c519028dd618608438bb1d2db05db6184869b0db0808d99dc1248a0b092e5c6fffedfefd54bd9b3abd7fe0efb58743de936fd58da1102ac2305a3
SSDEEP 3072:zpIKvJGYiHjLc0KXfxYZtpD9tvAz7G6EngK/ZH5lS:d3wLZKXKez7dJizS
TLSH
T11BF3385BB2A120F5D0B7C53889611A0AFBB2747283609BDF579446B61F337E09D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

19068

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

GetLastInputInfo

kernel32

WriteConsoleW QueryPerformanceCounter QueryPerformanceFrequency Sleep GetTickCount VirtualProtect RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW CreateFileW RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW RtlUnwind HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc CloseHandle

Name

.text

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-17_25d483ea48e35b4a5ee4e9eb0c0f046a_cobalt-strike_icedid_luca-stealer_njrat_stealc

user32

kernel32

generic