2026-07-22_3bfbb8afa6dcedbe72962b8132bd55ae_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-22_3bfbb8afa6dcedbe72962b8132bd55ae_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 472KB
Sample260723-cb55fsvsdx
SHA256 0781cb43630804367476dc2e1b470d79bda6d3d4faa53a2ba3384c13305f2d24
MD5 3bfbb8afa6dcedbe72962b8132bd55ae
SHA1 bb857ddc27efa704118789fda27765e4118acd9c
SHA512 e9d047617b6b61ecb1d6140979cbbc8a4df194a6a91672ab9b0319ffd827734b30a9c5a82cd0a58d6b939da668a30ea87090f83438f3be4a46ee8db96345ebd7
SSDEEP 12288:6hCYdXhHc+RLr1FVmJheHHtfQ9D+CLKoW/eGr4qA/E:p8i+R8heJr4V/E
TLSH
T15CA43A0ADBF804F8E1B396708EA14942D7777C4507B4D6CF139D486A1F6BA609E39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_3bfbb8afa6dcedbe72962b8132bd55ae_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-22_3bfbb8afa6dcedbe72962b8132bd55ae_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 472KB

2026-07-22_3bfbb8afa6dcedbe72962b8132bd55ae_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 1aeae1dc5bcd879907f3574d82aaf8f1
SHA256 0781cb43630804367476dc2e1b470d79bda6d3d4faa53a2ba3384c13305f2d24
MD5 3bfbb8afa6dcedbe72962b8132bd55ae
SHA1 bb857ddc27efa704118789fda27765e4118acd9c
SHA512 e9d047617b6b61ecb1d6140979cbbc8a4df194a6a91672ab9b0319ffd827734b30a9c5a82cd0a58d6b939da668a30ea87090f83438f3be4a46ee8db96345ebd7
SSDEEP 12288:6hCYdXhHc+RLr1FVmJheHHtfQ9D+CLKoW/eGr4qA/E:p8i+R8heJr4V/E
TLSH
T15CA43A0ADBF804F8E1B396708EA14942D7777C4507B4D6CF139D486A1F6BA609E39B23
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

170704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Projects\WinRAR\rar\build\sfxcon64\Release\sfxcon.pdb

kernel32

GetStdHandle GetFileType WriteFile GetConsoleMode SetConsoleMode ReadConsoleW WriteConsoleW GetLastError SetLastError Sleep LocalFree FormatMessageW SetConsoleCtrlHandler CreateFileW DeleteFileW RemoveDirectoryW SetFileTime CloseHandle DeviceIoControl CreateHardLinkW GetLongPathNameW GetShortPathNameW MoveFileW FlushFileBuffers ReadFile SetEndOfFile SetFilePointer CreateDirectoryW GetDriveTypeW GetFileAttributesW SetFileAttributesW GetCurrentProcessId FindClose FindFirstFileW FindNextFileW GetVersionExW GetCurrentDirectoryW GetModuleFileNameW FoldStringW SetErrorMode FreeLibrary GetProcAddress GetCurrentProcess ExitProcess GetSystemDirectoryW GetModuleHandleW LoadLibraryW SetThreadExecutionState CompareStringW AllocConsole FreeConsole AttachConsole InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateEventW CreateSemaphoreW CreateThread SetThreadPriority GetProcessAffinityMask FileTimeToLocalFileTime GetSystemTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SystemTimeToFileTime MultiByteToWideChar WideCharToMultiByte GetCPInfo IsDBCSLeadByte HeapSize SetFilePointerEx RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RtlUnwindEx EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW QueryPerformanceFrequency GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx LCMapStringW GetConsoleOutputCP SetStdHandle HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetStringTypeW

Name

.text

Size

269KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-22_3bfbb8afa6dcedbe72962b8132bd55ae_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

generic