2026-07-29_33b0f3348191204659213432a3998fd1_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-29_33b0f3348191204659213432a3998fd1_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 285KB
Sample260729-nbj3rssena
SHA256 e903bfba8cc732c7f75fc92168833624781773021d0173d427e1d70549788e67
MD5 33b0f3348191204659213432a3998fd1
SHA1 8ff0dd57ce3148516cf297e78aff6f9525987d13
SHA512 810949513919ed77647c064ae756aa15438bfb9092c948e312560711e7783bd0cadaa35eecdd2cc81a1b2c1d8ad838c8cb81912b19496afdd779c818301eefb4
SSDEEP 3072:gxX2AiIATLOi5j6W2wNMylK3M860CA/4aHiyq4rYkscJtbRG68p7YkhjHjepTlKu:gxXEA//9qEzRGv1K6w
TLSH
T138543A5ABAA560F5D9BBC03CC942250AFD7178A64770E7CB17904A972F237E0AD3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-29_33b0f3348191204659213432a3998fd1_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-29_33b0f3348191204659213432a3998fd1_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 285KB

2026-07-29_33b0f3348191204659213432a3998fd1_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH a9cb645167cdb183a3f5f295bf812f5f
SHA256 e903bfba8cc732c7f75fc92168833624781773021d0173d427e1d70549788e67
MD5 33b0f3348191204659213432a3998fd1
SHA1 8ff0dd57ce3148516cf297e78aff6f9525987d13
SHA512 810949513919ed77647c064ae756aa15438bfb9092c948e312560711e7783bd0cadaa35eecdd2cc81a1b2c1d8ad838c8cb81912b19496afdd779c818301eefb4
SSDEEP 3072:gxX2AiIATLOi5j6W2wNMylK3M860CA/4aHiyq4rYkscJtbRG68p7YkhjHjepTlKu:gxXEA//9qEzRGv1K6w
TLSH
T138543A5ABAA560F5D9BBC03CC942250AFD7178A64770E7CB17904A972F237E0AD3E701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71156

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wininet

InternetCloseHandle InternetOpenUrlA InternetReadFile InternetOpenA

gdiplus

GdipDrawString GdipDeleteStringFormat GdipCreateFont GdipDeleteFontFamily GdipCreateFontFamilyFromName GdipFillPath GdipFillEllipseI GdipFillRectangleI GdipDrawPath GdipDrawLineI GdipSetTextRenderingHint GdipSetSmoothingMode GdipDeleteGraphics GdipCreateFromHDC GdipSetPenLineCap197819 GdipDeletePen GdipCreatePen1 GdipCreateLineBrushI GdipCreateLineBrush GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipAddPathArcI GdipClosePathFigure GdipDeletePath GdipCreatePath GdiplusShutdown GdiplusStartup GdipFree GdipAlloc GdipCreateStringFormat GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipDeleteFont

gdi32

DeleteDC CreateCompatibleBitmap SelectObject DeleteObject BitBlt CreateRoundRectRgn CreateCompatibleDC

iphlpapi

GetAdaptersInfo

advapi32

GetUserNameW

shell32

ShellExecuteW

user32

LoadCursorA GetWindowRect GetClientRect InvalidateRect SetWindowRgn EndPaint BeginPaint UpdateWindow GetSystemMetrics ReleaseCapture LoadIconW SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcA DispatchMessageA TranslateMessage GetMessageA SetCapture

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue SetStdHandle GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize WriteConsoleW CreateFileW SetFilePointerEx WakeAllConditionVariable FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree ExitProcess GetModuleFileNameW WriteFile GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError GetLastError GetVolumeInformationA CloseHandle WaitForSingleObject CreateRemoteThread OpenProcess VirtualAllocEx ReadProcessMemory WriteProcessMemory VirtualFreeEx GetModuleHandleA GetProcAddress LoadLibraryA GetComputerNameW WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentThreadId EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetSystemTimeAsFileTime GetModuleHandleW GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException

Name

.text

Size

185KB

Virtual Size

184KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-29_33b0f3348191204659213432a3998fd1_cobalt-strike_icedid_luca-stealer_njrat_stealc

wininet

gdiplus

gdi32

iphlpapi

advapi32

shell32

user32

kernel32

generic