2026-08-03_09e09dd0b952114838f62d3fdbd68409_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-08-03_09e09dd0b952114838f62d3fdbd68409_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 196KB
Sample260804-d3khha1drd
SHA256 b176befa444ac2b469658acd1724bb4c28bd1f5512da6f38846a99c3509e35e7
MD5 09e09dd0b952114838f62d3fdbd68409
SHA1 20a50f635f79bcccf94b1d5bce2d9caf9511d9c9
SHA512 ed836cf0d8a715a42f0170342209f462259e8d60d4621a158496279b7240493db16309de1f851c5273ebb6d50b24e20df2d15035012a4d336bfa3fd05daf10a6
SSDEEP 3072:eSqUv31BAAL0d5LqXLlR9ORo72VtTGlskQvdWUyk1UNxo9hK2x8br:eSqUvlBAAkL2LbSVtKl+DDO
TLSH
T156147D15B7A510FAE9678778CA520901EB737C460770AADF07905BB29E336E09F3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_09e09dd0b952114838f62d3fdbd68409_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-03_09e09dd0b952114838f62d3fdbd68409_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 196KB

2026-08-03_09e09dd0b952114838f62d3fdbd68409_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH d24231bc8bea9f3d3ab091ae249f3a27
SHA256 b176befa444ac2b469658acd1724bb4c28bd1f5512da6f38846a99c3509e35e7
MD5 09e09dd0b952114838f62d3fdbd68409
SHA1 20a50f635f79bcccf94b1d5bce2d9caf9511d9c9
SHA512 ed836cf0d8a715a42f0170342209f462259e8d60d4621a158496279b7240493db16309de1f851c5273ebb6d50b24e20df2d15035012a4d336bfa3fd05daf10a6
SSDEEP 3072:eSqUv31BAAL0d5LqXLlR9ORo72VtTGlskQvdWUyk1UNxo9hK2x8br:eSqUvlBAAkL2LbSVtKl+DDO
TLSH
T156147D15B7A510FAE9678778CA520901EB737C460770AADF07905BB29E336E09F3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

36800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateMutexW Sleep GetCurrentProcessId CreateProcessW GetSystemInfo GetTickCount FreeLibrary GetModuleFileNameW GetProcAddress GetLastError LocalFree SetDllDirectoryW WideCharToMultiByte WriteConsoleW CreateFileW GetConsoleMode GetConsoleOutputCP FlushFileBuffers CloseHandle GetFileAttributesW LoadLibraryExW GetCommandLineW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap SetFilePointerEx HeapSize HeapReAlloc

user32

CharLowerW GetSystemMetrics MessageBoxW

shell32

CommandLineToArgvW

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

Name

.text

Size

120KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_09e09dd0b952114838f62d3fdbd68409_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

shell32

advapi32

generic