2026-07-31_676cb36b2db230870da8431bf541b5c6_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-31_676cb36b2db230870da8431bf541b5c6_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 518KB
Sample260731-dh4ewavvas
SHA256 3401d30271c650af8003727eb21e49ee7a11770d93e7e49691c229ffb8a95d1e
MD5 676cb36b2db230870da8431bf541b5c6
SHA1 b601db55a3194edf840c820c366637d2056fdde1
SHA512 3b47d0445ade930e69ef6e47b956148521a726f8e95ada3b0e9b40c20f28ca0fb6f1a4fc1e0fb1b9b0545771537f589dba46869d2ae11df7b570680c917fddc2
SSDEEP 6144:D+o9ewVYt4lOlDR5UmxOFAu8JqvA9puh28AtZciUHJKjq856XhE:DZauTA/Gzyh8J58IXh
TLSH
T1C9B48E16FB5405F6D0678134CCA38605E772BC4A4BA25ACB23E4775A2F336E05F3A791
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-31_676cb36b2db230870da8431bf541b5c6_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-07-31_676cb36b2db230870da8431bf541b5c6_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 518KB

2026-07-31_676cb36b2db230870da8431bf541b5c6_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH f3191877e49a874f2198d22012b3b865
SHA256 3401d30271c650af8003727eb21e49ee7a11770d93e7e49691c229ffb8a95d1e
MD5 676cb36b2db230870da8431bf541b5c6
SHA1 b601db55a3194edf840c820c366637d2056fdde1
SHA512 3b47d0445ade930e69ef6e47b956148521a726f8e95ada3b0e9b40c20f28ca0fb6f1a4fc1e0fb1b9b0545771537f589dba46869d2ae11df7b570680c917fddc2
SSDEEP 6144:D+o9ewVYt4lOlDR5UmxOFAu8JqvA9puh28AtZciUHJKjq856XhE:DZauTA/Gzyh8J58IXh
TLSH
T1C9B48E16FB5405F6D0678134CCA38605E772BC4A4BA25ACB23E4775A2F336E05F3A791
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

109560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Admin\source\repos\NG_QLTool\x64\Release\NG_QLTool.pdb

kernel32

DeleteFileW Process32FirstW CloseHandle GetFileSize ExitProcess WideCharToMultiByte GetTickCount MulDiv WriteConsoleW HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetSystemDirectoryA GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx GetProcessId GetFileType HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc Process32NextW GetLastError Sleep MultiByteToWideChar CreateToolhelp32Snapshot SetFileAttributesW OpenProcess ReleaseMutex CreateFileW GetVolumeInformationA FindClose GetOEMCP CreateMutexW SetEnvironmentVariableW GetModuleFileNameW TerminateProcess WriteFile HeapFree HeapAlloc GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree FindNextFileW GetFileSizeEx FindFirstFileW ReadFile TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader GetStringTypeW GetCurrentThreadId LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx

user32

RegisterClassExW EnableWindow EndPaint BeginPaint ReleaseDC InvalidateRect UpdateWindow PostQuitMessage KillTimer DrawTextW GetClientRect SetCursor LoadCursorW GetMessageW DefWindowProcW PostMessageW DestroyWindow InflateRect GetDC MessageBoxW LoadIconW CreateWindowExW SendMessageW SetWindowTextW FillRect ShowWindow GetAsyncKeyState DispatchMessageW SetTimer TrackMouseEvent IsWindowEnabled MoveWindow AdjustWindowRect TranslateMessage

gdi32

SelectObject CreateFontW GetStockObject GetDeviceCaps SetTextColor SetBkMode LineTo CreatePen MoveToEx DeleteObject CreateSolidBrush RoundRect

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA

shell32

ShellExecuteW ShellExecuteExW

winhttp

WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpQueryDataAvailable WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest

comctl32

InitCommonControlsEx ord413 ord410 ord412

wininet

InternetOpenW InternetCloseHandle InternetReadFile InternetOpenUrlW

shlwapi

PathFileExistsW PathCombineW PathRemoveFileSpecW

Name

.text

Size

237KB

Virtual Size

236KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

94KB

Virtual Size

93KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

163KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-07-31_676cb36b2db230870da8431bf541b5c6_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

gdi32

advapi32

shell32

winhttp

comctl32

wininet

shlwapi

generic