2026-07-29_2480b580037709b06c5feb997909ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_2480b580037709b06c5feb997909ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 653KB
Sample260729-ddj6fashld
SHA256 cfda1896b760b701d955e575bbb80dbd4fd45f8bfcd36e1634e49a4b8699046b
MD5 2480b580037709b06c5feb997909ca84
SHA1 0fe9112fc8831bbc6dc1c79dd96621829b58bef0
SHA512 22f00e12c476e2459124c4bbd39b850d5fff2f015f1d3beb241a53ee77b72a2b03e4bfb25f145869785ec58d8dd0ad9d9a0e85ee07de556181fe86c444ccd20e
SSDEEP 6144:rSS3aH3SPaj6j6+5Q2aW9S10tdIK38B9GBJ5uvTlcSG0opaItsC1avyKpnqeSgZP:nayT9X38BcBDu9GPVtpA5qeS8iMnUM
TLSH
T1C2E4AE45B2E441FCD067913BC9825A2BFB76381A0B2057DB23F44A562F6B7E09E7B311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_2480b580037709b06c5feb997909ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-29_2480b580037709b06c5feb997909ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 653KB

2026-07-29_2480b580037709b06c5feb997909ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 218fc28b24b03866b1165e4d5b87f77c
SHA256 cfda1896b760b701d955e575bbb80dbd4fd45f8bfcd36e1634e49a4b8699046b
MD5 2480b580037709b06c5feb997909ca84
SHA1 0fe9112fc8831bbc6dc1c79dd96621829b58bef0
SHA512 22f00e12c476e2459124c4bbd39b850d5fff2f015f1d3beb241a53ee77b72a2b03e4bfb25f145869785ec58d8dd0ad9d9a0e85ee07de556181fe86c444ccd20e
SSDEEP 6144:rSS3aH3SPaj6j6+5Q2aW9S10tdIK38B9GBJ5uvTlcSG0opaItsC1avyKpnqeSgZP:nayT9X38BcBDu9GPVtpA5qeS8iMnUM
TLSH
T1C2E4AE45B2E441FCD067913BC9825A2BFB76381A0B2057DB23F44A562F6B7E09E7B311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

321872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Desktop\cpp_launcher\x64\Release\cpp_launcher.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

winhttp

WinHttpCrackUrl WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest

kernel32

GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc GetTempPathA CreateDirectoryA GetTickCount WriteProcessMemory WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Process32NextW Process32FirstW CloseHandle GetProcAddress VirtualAllocEx CreateRemoteThread VirtualFreeEx GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter ReadConsoleW FreeEnvironmentStringsW GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx CreateProcessW GetExitCodeProcess GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc WriteFile GetStdHandle GetModuleFileNameW ExitProcess ReadFile GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue SetEnvironmentVariableW GetProcessHeap SetStdHandle TlsGetValue TlsAlloc HeapSize WriteConsoleW SetEndOfFile GetConsoleMode GetModuleHandleW LocalFree FormatMessageA GetLocaleInfoEx CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError RtlUnwind GetFileInformationByHandleEx GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount

user32

GetKeyState GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW GetWindowRect DestroyWindow SetWindowPos CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow DispatchMessageW PeekMessageW TranslateMessage PostQuitMessage UpdateWindow GetCursorPos

shell32

ShellExecuteA

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

.text

Size

491KB

Virtual Size

490KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_2480b580037709b06c5feb997909ca84_cobalt-strike_icedid_luca-stealer_njrat_stealc

d3d11

d3dcompiler_47

winhttp

kernel32

user32

shell32

imm32

generic