General
- Target 2026-08-01_8e5a9c06b4b21c972825bee70ab69268_cobalt-strike_icedid_luca-stealer_njrat_stealc
- Size 779KB
- Sample260801-fmcttswsaz
- SHA256 e4f4cc70eed17061b50efde80a3e07dbb3fb0e220166157644b450c720a847f5
- MD5 8e5a9c06b4b21c972825bee70ab69268
- SHA1 c8e09ba127e214086c101468cc2aba7a07c75a6c
- SHA512 7ca9772fb04a7138de4f81d0c071dd5f0da1094f16ac6de38cd9b0b5cb30d1c7a8f81b0b6ab58330ea2082279db2b52b4a1acbdee90d82e6e34f1e82649e280a
- SSDEEP 6144:Mk6z+vIk/+LDSGtqtq/LLI3U61HCMIfvBYLcYxAPi/bx/cgIh4gTOI6e/tMuQXnj:Qz5g+pfLrU3XgazuQXnpF9qVIWW7OS
- TLSH T156052A2A5B9402BCF0B7D27ACE959D52EB35740E03F2ADDF0B9044A65E671A04F3A713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
2026-08-01_8e5a9c06b4b21c972825bee70ab69268_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Resource
win10v2004-20260513-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_8e5a9c06b4b21c972825bee70ab69268_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Resource
win11ltsc2024-20260709-en
2 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-01_8e5a9c06b4b21c972825bee70ab69268_cobalt-strike_icedid_luca-stealer_njrat_stealc
- Size 779KB
- SHA256 e4f4cc70eed17061b50efde80a3e07dbb3fb0e220166157644b450c720a847f5
- MD5 8e5a9c06b4b21c972825bee70ab69268
- SHA1 c8e09ba127e214086c101468cc2aba7a07c75a6c
- SHA512 7ca9772fb04a7138de4f81d0c071dd5f0da1094f16ac6de38cd9b0b5cb30d1c7a8f81b0b6ab58330ea2082279db2b52b4a1acbdee90d82e6e34f1e82649e280a
- SSDEEP 6144:Mk6z+vIk/+LDSGtqtq/LLI3U61HCMIfvBYLcYxAPi/bx/cgIh4gTOI6e/tMuQXnj:Qz5g+pfLrU3XgazuQXnpF9qVIWW7OS
- TLSH T156052A2A5B9402BCF0B7D27ACE959D52EB35740E03F2ADDF0B9044A65E671A04F3A713
- MD5 SHA1 SHA512 SSDEEP TLSH
Score6/10-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.