2026-08-01_f732feab7d71a07b2d5fb447fc43403f_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-01_f732feab7d71a07b2d5fb447fc43403f_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 825KB
Sample260801-md26pasema
SHA256 3586fc10b492f7e0923e6d8db44d0f6abb184b4a86120d94e47cef93e6cf65bb
MD5 f732feab7d71a07b2d5fb447fc43403f
SHA1 12c00e84a77622a5100d4c69eebbfe49a73e18b1
SHA512 835e372e36100b43b261584c02f473d7489232d9a1e91a384a1f1a5ac90a9f2cb2ba67263f4f91b3ec13a42a91380e21b1bd685de523f5d327371283c6ab6b1e
SSDEEP 12288:22obxQJ7jnw7hAow0iYCrBwSq00dlCPF9vtB2RE9LprVTZ8GqR:W6J7jnw7hAowBdradUtBW2JN
TLSH
T165058E266B9401FCE0B7C179CE869D52EB71B80A03B05AEF07A085A55F376F45F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_References_SecTools

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-01_f732feab7d71a07b2d5fb447fc43403f_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-01_f732feab7d71a07b2d5fb447fc43403f_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 825KB

2026-08-01_f732feab7d71a07b2d5fb447fc43403f_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 8ab66b05bf7ce63293e715920ab59cda
SHA256 3586fc10b492f7e0923e6d8db44d0f6abb184b4a86120d94e47cef93e6cf65bb
MD5 f732feab7d71a07b2d5fb447fc43403f
SHA1 12c00e84a77622a5100d4c69eebbfe49a73e18b1
SHA512 835e372e36100b43b261584c02f473d7489232d9a1e91a384a1f1a5ac90a9f2cb2ba67263f4f91b3ec13a42a91380e21b1bd685de523f5d327371283c6ab6b1e
SSDEEP 12288:22obxQJ7jnw7hAow0iYCrBwSq00dlCPF9vtB2RE9LprVTZ8GqR:W6J7jnw7hAowBdradUtBW2JN
TLSH
T165058E266B9401FCE0B7C179CE869D52EB71B80A03B05AEF07A085A55F376F45F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Detects executables referencing many IR and analysis tools
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

462788

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse

ws2_32

accept bind closesocket connect htons listen recv select send setsockopt gethostname __WSAFDIsSet inet_ntop inet_pton ntohl htonl getsockopt ioctlsocket freeaddrinfo getaddrinfo socket WSAStartup

advapi32

RegSaveKeyA LogonUserA LookupAccountSidA DuplicateTokenEx GetUserNameA GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken OpenServiceW CreateServiceW ChangeServiceConfig2W RegDeleteTreeW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW CryptGenRandom CryptReleaseContext CryptAcquireContextW QueryServiceStatusEx OpenSCManagerW EnumServicesStatusExW ControlService RegDeleteValueA RegDeleteKeyA StartServiceA QueryServiceConfigA OpenServiceA DeleteService CreateServiceA ChangeServiceConfigA LookupPrivilegeValueA AdjustTokenPrivileges ConvertSidToStringSidA CreateProcessWithLogonW RegCloseKey RegEnumValueA RegOpenKeyExA RegQueryValueExA RegQueryInfoKeyA CreateProcessAsUserA AllocateAndInitializeSid CheckTokenMembership FreeSid ImpersonateLoggedOnUser RevertToSelf CloseServiceHandle OpenSCManagerA ImpersonateNamedPipeClient OpenThreadToken RegCreateKeyExA RegSetValueExA RegDeleteTreeA

ole32

CLSIDFromString CoUninitialize CoCreateInstanceEx CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantInit VariantClear SafeArrayCreate SafeArrayDestroy SafeArrayAccessData SafeArrayUnaccessData SafeArrayPutElement SafeArrayCreateVector

shell32

SHGetFolderPathW SHGetFolderPathA

bcrypt

BCryptOpenAlgorithmProvider BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptEncrypt BCryptDecrypt BCryptDestroyKey BCryptGenRandom

kernel32

GetConsoleMode ReadConsoleW SetFilePointerEx GetFileType GetConsoleOutputCP GetFileSizeEx HeapReAlloc GetTimeZoneInformation FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW GetCommandLineA GetModuleFileNameW GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RtlUnwindEx RaiseException RtlPcToFileHeader InitializeSListHead GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW WakeAllConditionVariable LCMapStringEx GetCPInfo CompareStringEx DecodePointer EncodePointer GetEnvironmentStrings FreeEnvironmentStringsA SetEnvironmentVariableW CreateDirectoryA DeleteFileA GetFileAttributesA ReadFile CloseHandle SetHandleInformation GetLastError CreatePipe WaitForSingleObject ExitProcess GetExitCodeProcess ResumeThread GetModuleFileNameA CopyFileA MoveFileExA MultiByteToWideChar SetEvent CreateEventW Sleep VirtualProtect CreateThreadpoolTimer SetThreadpoolTimer CloseThreadpoolTimer GetModuleHandleExA GetProcAddress LoadLibraryA IsDebuggerPresent CheckRemoteDebuggerPresent GetCurrentProcess GlobalMemoryStatusEx GetSystemInfo GetModuleHandleA CreateToolhelp32Snapshot Process32FirstW Process32NextW DuplicateHandle QueueUserAPC CreateRemoteThread CreateProcessA OpenProcess VirtualAlloc VirtualFree VirtualAllocEx VirtualProtectEx WriteProcessMemory VirtualFreeEx FindClose GetComputerNameA WideCharToMultiByte FreeLibrary GlobalUnlock GlobalLock ConnectNamedPipe DisconnectNamedPipe CreateEventA GetCurrentThread TerminateProcess OpenThread SuspendThread GetThreadContext SetThreadContext Thread32First Thread32Next CreateFileA ReadProcessMemory HeapAlloc HeapFree GetProcessHeap InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute Process32First Process32Next SetCurrentDirectoryA GetCurrentDirectoryA GetCurrentProcessId LocalFree GetTempPathA CreateThread WriteFile GetStdHandle SetStdHandle GetProcessHeaps HeapLock HeapUnlock HeapWalk GetCurrentThreadId FlushInstructionCache Module32First Module32Next DeleteFileW CopyFileW GetModuleHandleW GetSystemTimeAsFileTime DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection InitOnceComplete InitOnceBeginInitialize FlushFileBuffers CreateFileW HeapSize SetEndOfFile WriteConsoleW SetEnvironmentVariableA CreateNamedPipeA GetExitCodeThread WaitForSingleObjectEx SleepConditionVariableSRW QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive

user32

OpenClipboard ReleaseDC GetDC GetSystemMetrics PeekMessageA CallNextHookEx GetClipboardData SetWindowsHookExA GetWindowTextA GetForegroundWindow MapVirtualKeyA ToUnicode GetKeyboardState GetKeyState CloseClipboard TranslateMessage UnhookWindowsHookEx DispatchMessageA GetAsyncKeyState

gdi32

GetDIBits BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject

dbghelp

MiniDumpWriteDump

mscoree

CLRCreateInstance

Name

.text

Size

623KB

Virtual Size

623KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

154KB

Virtual Size

154KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-01_f732feab7d71a07b2d5fb447fc43403f_cobalt-strike_icedid_luca-stealer_njrat_stealc

winhttp

ws2_32

advapi32

ole32

oleaut32

shell32

bcrypt

kernel32

user32

gdi32

dbghelp

mscoree

generic