2026-08-02_b0f976472a69fba9e0f851ee3b9ac7a2_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_b0f976472a69fba9e0f851ee3b9ac7a2_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 361KB
Sample260802-m27fbaha54
SHA256 9b13964718e7504c883294a6a08ff2828f1ba7a60734fe06dd2228685ec5eb7e
MD5 b0f976472a69fba9e0f851ee3b9ac7a2
SHA1 78f872b50d99a41a76e2c1256d59ec32cf7dd7d0
SHA512 cd9b97f7fbc4671927236f696ea91e1b38f21202b1757ce815b0b905db17bdb8cc16ff32c53b72160095ad38d65c5f650540128a43a86b0a7cbc45fefe466657
SSDEEP 6144:SYOl7+VHg5nq7mx8qsx5CdFLBFqUVLTmx6Bp:iyS5lCgdFVQKLa
TLSH
T13E748D1AF7A804F9E167D178C9625407EB727C5E4760AACF23A04A971F336E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_b0f976472a69fba9e0f851ee3b9ac7a2_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-02_b0f976472a69fba9e0f851ee3b9ac7a2_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 361KB

2026-08-02_b0f976472a69fba9e0f851ee3b9ac7a2_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 6a33b50b0033bcf0b272430010a169f7
SHA256 9b13964718e7504c883294a6a08ff2828f1ba7a60734fe06dd2228685ec5eb7e
MD5 b0f976472a69fba9e0f851ee3b9ac7a2
SHA1 78f872b50d99a41a76e2c1256d59ec32cf7dd7d0
SHA512 cd9b97f7fbc4671927236f696ea91e1b38f21202b1757ce815b0b905db17bdb8cc16ff32c53b72160095ad38d65c5f650540128a43a86b0a7cbc45fefe466657
SSDEEP 6144:SYOl7+VHg5nq7mx8qsx5CdFLBFqUVLTmx6Bp:iyS5lCgdFVQKLa
TLSH
T13E748D1AF7A804F9E167D178C9625407EB727C5E4760AACF23A04A971F336E09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

119016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Documents\Cruz-External\x64\Release\Cruz-External.pdb

d2d1

ord1

dwrite

DWriteCreateFactory

kernel32

MultiByteToWideChar GetModuleHandleW WideCharToMultiByte Sleep WriteProcessMemory WaitForSingleObject CloseHandle GetProcAddress VirtualAllocEx ReadProcessMemory CreateRemoteThread VirtualFreeEx VirtualQueryEx CreateFileW HeapSize SetStdHandle WriteConsoleW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx LeaveCriticalSection GetFileSizeEx GetFileType EnumSystemLocalesW QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW WaitForSingleObjectEx GetExitCodeThread InitializeCriticalSectionEx GetSystemTimeAsFileTime WakeAllConditionVariable EncodePointer DecodePointer EnterCriticalSection RtlUnwind DeleteCriticalSection LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID

user32

SetLayeredWindowAttributes FindWindowA GetClientRect MessageBoxA DefWindowProcW DestroyWindow SetWindowPos CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow MapWindowPoints MoveWindow PeekMessageW LoadCursorW UpdateWindow IsIconic GetAsyncKeyState DispatchMessageW TranslateMessage

gdi32

CreateSolidBrush

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

Name

.text

Size

251KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_b0f976472a69fba9e0f851ee3b9ac7a2_cobalt-strike_icedid_luca-stealer_njrat_stealc

d2d1

dwrite

kernel32

user32

gdi32

dwmapi

d3d11

generic