2026-08-02_9abf2f612f6ec99b1190bf35e8e945af_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-02_9abf2f612f6ec99b1190bf35e8e945af_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 235KB
Sample260802-m84yrsyshv
SHA256 963bebd8dd5ade209a33d18553c150fb498a2357e47c68d19bc79dac10d61c88
MD5 9abf2f612f6ec99b1190bf35e8e945af
SHA1 57c711a9f700fbe0f51b5750e8acf64b02ca3654
SHA512 6839b598d14944f5cb23bfb3e6195cdc3d5b3f60494ffe12164c1ec58cb70b99efb8fcde8227e479a114b9f46bb3047f3ba3e188cc090e1815c4be9a5d81ccb3
SSDEEP 3072:7UMV6MadbHMBpHvTMSeqmi4CVLfEldyrL6zYO3Wzf0pWsX/x5Jw0oB0snO:qbMBpH7Z5iW70XX/xeasO
TLSH
T18C348D9A73A444ECCC3BA0B1E8210196E336B4F98750B6DF53E522366F966E05D3DF12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-02_9abf2f612f6ec99b1190bf35e8e945af_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-02_9abf2f612f6ec99b1190bf35e8e945af_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 235KB

2026-08-02_9abf2f612f6ec99b1190bf35e8e945af_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 17645483836230cea76f679f5eac33cd
SHA256 963bebd8dd5ade209a33d18553c150fb498a2357e47c68d19bc79dac10d61c88
MD5 9abf2f612f6ec99b1190bf35e8e945af
SHA1 57c711a9f700fbe0f51b5750e8acf64b02ca3654
SHA512 6839b598d14944f5cb23bfb3e6195cdc3d5b3f60494ffe12164c1ec58cb70b99efb8fcde8227e479a114b9f46bb3047f3ba3e188cc090e1815c4be9a5d81ccb3
SSDEEP 3072:7UMV6MadbHMBpHvTMSeqmi4CVLfEldyrL6zYO3Wzf0pWsX/x5Jw0oB0snO:qbMBpH7Z5iW70XX/xeasO
TLSH
T18C348D9A73A444ECCC3BA0B1E8210196E336B4F98750B6DF53E522366F966E05D3DF12
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32388

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Build\Build_2021n_D20250919T171028\fa_rss\AppStoreSRV\x64\Release\AppStoreSRV.pdb

wtsapi32

WTSFreeMemory WTSEnumerateSessionsW WTSQueryUserToken

kernel32

GetLastError CreateEventW CreateThread SetEvent GetFileAttributesW DeleteFileW FindFirstFileW FindClose FindNextFileW RemoveDirectoryW CopyFileW Sleep MultiByteToWideChar TerminateProcess FindResourceExW LocalAlloc LocalFree ReleaseMutex CreateMutexW CreateFileMappingW MapViewOfFile WaitForMultipleObjects UnmapViewOfFile InitializeCriticalSectionEx DeleteCriticalSection GetConsoleMode GetConsoleOutputCP FlushFileBuffers FindResourceW LoadResource LockResource SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy WaitForSingleObject CloseHandle GetExitCodeProcess CreateFileW WriteConsoleW GetCurrentProcess GetStringTypeW SetStdHandle SetEnvironmentVariableW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetFileType SetFilePointerEx FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW

user32

wsprintfW

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor ConvertSidToStringSidW CreateProcessAsUserW GetLengthSid SetTokenInformation ConvertStringSidToSidW DuplicateTokenEx GetTokenInformation SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RegCloseKey RegQueryValueExW RegOpenKeyExW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

Name

.text

Size

118KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-02_9abf2f612f6ec99b1190bf35e8e945af_cobalt-strike_icedid_luca-stealer_njrat_stealc

wtsapi32

kernel32

user32

advapi32

userenv

generic