2026-07-30_d93a66948f8225d950b892d2b4001e36_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_d93a66948f8225d950b892d2b4001e36_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 316KB
Sample260730-r8plasbb94
SHA256 e3da580f9cd0d87008faf345c2dce009d4f9dd0368a5623edbf7f82be7bab2c1
MD5 d93a66948f8225d950b892d2b4001e36
SHA1 9345ec9582d59ad1a10efe8bac4abe5fbff1be49
SHA512 628a8e47db88c259acdec82193e0d99733f878464f78d0d0830a6295773f322332a9ec9d703205e12d7662178c928cef786dd83819fd4bcb51b5eb80a40650ff
SSDEEP 3072:NewMxYAUmDszOkqg6HyLPz+PGNWn5pB1j7F+iPvIw/CaCaZuJiOLPLUpgJwt87Fc:Mlypv6tGEn5f1/QUvIx4OTvtjeMM
TLSH
T1B0647C59F7A510F9EAB7C13CCA524905EB727C424761E6CF13A04A9B2F236D09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_d93a66948f8225d950b892d2b4001e36_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-30_d93a66948f8225d950b892d2b4001e36_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 316KB

2026-07-30_d93a66948f8225d950b892d2b4001e36_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 4af74d97113a40ae9d3cf40aedb68d57
SHA256 e3da580f9cd0d87008faf345c2dce009d4f9dd0368a5623edbf7f82be7bab2c1
MD5 d93a66948f8225d950b892d2b4001e36
SHA1 9345ec9582d59ad1a10efe8bac4abe5fbff1be49
SHA512 628a8e47db88c259acdec82193e0d99733f878464f78d0d0830a6295773f322332a9ec9d703205e12d7662178c928cef786dd83819fd4bcb51b5eb80a40650ff
SSDEEP 3072:NewMxYAUmDszOkqg6HyLPz+PGNWn5pB1j7F+iPvIw/CaCaZuJiOLPLUpgJwt87Fc:Mlypv6tGEn5f1/QUvIx4OTvtjeMM
TLSH
T1B0647C59F7A510F9EAB7C13CCA524905EB727C424761E6CF13A04A9B2F236D09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

71364

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

shell32

SHFileOperationW

kernel32

GetFileSizeEx SetHandleInformation HeapFree WriteFile TerminateProcess GetModuleFileNameW InitializeProcThreadAttributeList CreatePipe WaitForSingleObject CreateFileW GetLastError UpdateProcThreadAttribute ReadFile GetNativeSystemInfo DeleteProcThreadAttributeList HeapAlloc GetProcAddress GetProcessHeap CreateProcessW GetModuleHandleW GetConsoleWindow AllocConsole GetExitCodeProcess WriteConsoleW HeapSize SetStdHandle CreateDirectoryW SetEndOfFile CloseHandle EncodePointer SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency GetStringTypeW WideCharToMultiByte GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW Sleep WaitForSingleObjectEx GetExitCodeThread InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection RtlUnwind DecodePointer LCMapStringEx WakeAllConditionVariable GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle ExitProcess GetCommandLineA GetCommandLineW SetFilePointerEx GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage

user32

ShowWindow

advapi32

RegCreateKeyExW RegSetValueExW RegCloseKey

wininet

InternetOpenW InternetCloseHandle InternetReadFile InternetOpenUrlW

Name

.text

Size

206KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-30_d93a66948f8225d950b892d2b4001e36_cobalt-strike_icedid_luca-stealer_njrat_stealc

shell32

kernel32

user32

advapi32

wininet

generic