2026-07-28_ba974e16e90239e7eb6cef3a35d96649_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-28_ba974e16e90239e7eb6cef3a35d96649_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 253KB
Sample260729-atbbpassgw
SHA256 d71d921914e140e4ca70c4ae6986784c9b0c737e21f919e84be2a4a15deb2ad8
MD5 ba974e16e90239e7eb6cef3a35d96649
SHA1 44803699089ea5e95a920517eee6fbd51fbd79ce
SHA512 8a8ef5ec0eda0f484f4d2c786536ba9f9e02647c1c7418d76016d4e67f3ced6e1bbe2f9108cd16a9d34be50c61f44e40c4612566f6d9736ffb0e8928c93180d9
SSDEEP 3072:UZnzLdeUZRlNES4nkhHzor9qfqFHL+g1AwS9eINvpOC/N2KIykmiKgJgU3wg:C/hZLNES4khH4wKNtSfzOC/klJl3H
TLSH
T139448D0A77B408FAF577967ACD618906DB727C124770D6DF13600A929E23BD09E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-07-28_ba974e16e90239e7eb6cef3a35d96649_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 253KB

2026-07-28_ba974e16e90239e7eb6cef3a35d96649_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 8eedd9b9e12efb69d698cdcbe91a03bf
SHA256 d71d921914e140e4ca70c4ae6986784c9b0c737e21f919e84be2a4a15deb2ad8
MD5 ba974e16e90239e7eb6cef3a35d96649
SHA1 44803699089ea5e95a920517eee6fbd51fbd79ce
SHA512 8a8ef5ec0eda0f484f4d2c786536ba9f9e02647c1c7418d76016d4e67f3ced6e1bbe2f9108cd16a9d34be50c61f44e40c4612566f6d9736ffb0e8928c93180d9
SSDEEP 3072:UZnzLdeUZRlNES4nkhHzor9qfqFHL+g1AwS9eINvpOC/N2KIykmiKgJgU3wg:C/hZLNES4khH4wKNtSfzOC/klJl3H
TLSH
T139448D0A77B408FAF577967ACD618906DB727C124770D6DF13600A929E23BD09E3E722
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

ae:14:f1:2c:04:2b:9c:f2:61:2c:b8:fa:bc:92:55:a8:eb:51:77:3e:0e:e4:e0:fb:2b:49:94:a8:6a:f3:fa:e0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=GsR 1164,CN=Argotronic eGbR,O=Argotronic eGbR,STREET=Josef-Wirth-Weg 16 a,L=Muenchen,ST=Bayern,C=DE,1.2.840.113549.1.9.1=#0c197a6572746966696b6174406172676f74726f6e69632e636f6d,1.3.6.1.4.1.311.60.2.1.1=#13084d75656e6368656e,1.3.6.1.4.1.311.60.2.1.2=#130642617965726e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 11, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

07:9f:48:38:5f:e3:9d:c5:bf:79:f7:49

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 26, 2025 - Nov 26, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

45772

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

P:\AM\ToolApplications\GpuControl\x64\Release\GpuControl.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

advapi32

SetSecurityDescriptorDacl AllocateAndInitializeSid FreeSid AddAccessAllowedAce InitializeSecurityDescriptor InitializeAcl

kernel32

ReadConsoleW WriteConsoleW TlsGetValue ReadFile GetProcAddress FreeLibrary LoadLibraryExW GetModuleFileNameW CreateMutexW WaitForSingleObject ReleaseMutex OpenFileMappingW UnmapViewOfFile Sleep GetTickCount64 CloseHandle MapViewOfFile OpenMutexW GetLocalTime CreateToolhelp32Snapshot Process32NextW Process32FirstW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetEndOfFile RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetProcessHeap SetStdHandle GetStringTypeW GetFileSizeEx SetFilePointerEx CreateFileW FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize HeapReAlloc

ctlAUXAccess ctlCheckDriverVersion ctlClose ctlEdidManagement ctlEngineGetActivity ctlEngineGetProperties ctlEnumEngineGroups ctlEnumFans ctlEnumFrequencyDomains ctlEnumMemoryModules ctlEnumPowerDomains ctlEnumTemperatureSensors ctlEnumerateDevices ctlEnumerateDisplayOutputs ctlEnumerateI2CPinPairs ctlEnumerateMuxDevices ctlFanGetConfig ctlFanGetProperties ctlFanGetState ctlFanSetDefaultMode ctlFanSetFixedSpeedMode ctlFanSetSpeedTableMode ctlFrequencyGetAvailableClocks ctlFrequencyGetProperties ctlFrequencyGetRange ctlFrequencyGetState ctlFrequencyGetThrottleTime ctlFrequencySetRange ctlGetAdaperDisplayEncoderProperties ctlGetBrightnessSetting ctlGetCurrentScaling ctlGetCurrentSharpness ctlGetDeviceProperties ctlGetDisplayProperties ctlGetIntelArcSyncInfoForMonitor ctlGetIntelArcSyncProfile ctlGetLACEConfig ctlGetLinkedDisplayAdapters ctlGetMuxProperties ctlGetPowerOptimizationCaps ctlGetPowerOptimizationSetting ctlGetSet3DFeature ctlGetSetCombinedDisplay ctlGetSetCustomMode ctlGetSetDisplayGenlock ctlGetSetDynamicContrastEnhancement ctlGetSetRetroScaling ctlGetSetVideoProcessingFeature ctlGetSharpnessCaps ctlGetSupported3DCapabilities ctlGetSupportedRetroScalingCapability ctlGetSupportedScalingCapability ctlGetSupportedVideoProcessingCapabilities ctlGetVblankTimestamp ctlGetZeDevice ctlI2CAccess ctlI2CAccessOnPinPair ctlInit ctlLinkDisplayAdapters ctlMemoryGetBandwidth ctlMemoryGetProperties ctlMemoryGetState ctlOverclockGetProperties ctlOverclockGpuFrequencyOffsetGet ctlOverclockGpuFrequencyOffsetSet ctlOverclockGpuLockGet ctlOverclockGpuLockSet ctlOverclockGpuVoltageOffsetGet ctlOverclockGpuVoltageOffsetSet ctlOverclockPowerLimitGet ctlOverclockPowerLimitSet ctlOverclockResetToDefault ctlOverclockTemperatureLimitGet ctlOverclockTemperatureLimitSet ctlOverclockVramFrequencyOffsetGet ctlOverclockVramFrequencyOffsetSet ctlOverclockVramVoltageOffsetGet ctlOverclockVramVoltageOffsetSet ctlOverclockWaiverSet ctlPanelDescriptorAccess ctlPciGetProperties ctlPciGetState ctlPixelTransformationGetConfig ctlPixelTransformationSetConfig ctlPowerGetEnergyCounter ctlPowerGetLimits ctlPowerGetProperties ctlPowerSetLimits ctlPowerTelemetryGet ctlReservedCall ctlSetBrightnessSetting ctlSetCurrentScaling ctlSetCurrentSharpness ctlSetIntelArcSyncProfile ctlSetLACEConfig ctlSetPowerOptimizationSetting ctlSetRuntimePath ctlSoftwarePSR ctlSwitchMux ctlTemperatureGetProperties ctlTemperatureGetState ctlUnlinkDisplayAdapters ctlWaitForPropertyChange

Name

.text

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-28_ba974e16e90239e7eb6cef3a35d96649_cobalt-strike_icedid_luca-stealer_njrat_stealc

version

advapi32

kernel32

generic