2026-08-03_5d2ab6b77987597b4f811dd856f42bb4_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-03_5d2ab6b77987597b4f811dd856f42bb4_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 460KB
Sample260804-ddfg9a1are
SHA256 102e92b07c46fb25634e80a83effdbd8d23e708a67cc111b16132a4415cd94cf
MD5 5d2ab6b77987597b4f811dd856f42bb4
SHA1 6b6136ba6b8db55ebe1e93073cf9b49cd10dbcae
SHA512 7100929df238884959dea9db8be67b3b79400053f33c3b8fcbb8ba7580609cb7127322d69346d249e1aed285137378acf9f2b8905ee0b6a6bacd4c46c3dac1e0
SSDEEP 6144:f+Dq4BaJSAkXxFsCH7BTu6w4YaYAjpBfxuiRby3z36K1yfJtvfmk6QXhrZWQxxC:5JSACwMNhxlxIlERpmkXRIQDC
TLSH
T172A45C29A69801F9E177C17DCA978C02E6767C4A0770EEDB03949A771F276D08E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-03_5d2ab6b77987597b4f811dd856f42bb4_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-03_5d2ab6b77987597b4f811dd856f42bb4_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 460KB

2026-08-03_5d2ab6b77987597b4f811dd856f42bb4_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 7d9d363863bc65f79652eb034f801450
SHA256 102e92b07c46fb25634e80a83effdbd8d23e708a67cc111b16132a4415cd94cf
MD5 5d2ab6b77987597b4f811dd856f42bb4
SHA1 6b6136ba6b8db55ebe1e93073cf9b49cd10dbcae
SHA512 7100929df238884959dea9db8be67b3b79400053f33c3b8fcbb8ba7580609cb7127322d69346d249e1aed285137378acf9f2b8905ee0b6a6bacd4c46c3dac1e0
SSDEEP 6144:f+Dq4BaJSAkXxFsCH7BTu6w4YaYAjpBfxuiRby3z36K1yfJtvfmk6QXhrZWQxxC:5JSACwMNhxlxIlERpmkXRIQDC
TLSH
T172A45C29A69801F9E177C17DCA978C02E6767C4A0770EEDB03949A771F276D08E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

170616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CryptUnprotectData CryptStringToBinaryA

advapi32

RegCloseKey SetEntriesInAclW RegQueryValueExW SetNamedSecurityInfoW RegOpenKeyExW

shlwapi

PathFindFileNameW PathFindExtensionW

user32

GetSystemMetrics GetDC ReleaseDC ShowWindow

bcrypt

BCryptGenerateSymmetricKey BCryptDestroyKey BCryptGetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty

gdi32

DeleteObject DeleteDC CreateCompatibleDC BitBlt CreateCompatibleBitmap SelectObject

ole32

CreateStreamOnHGlobal CoUninitialize CoInitialize CLSIDFromString

shell32

SHGetFolderPathW

gdiplus

GdipFree GdiplusShutdown GdipCloneImage GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipSaveImageToStream GdiplusStartup

kernel32

GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW SetFilePointerEx GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW HeapSize VirtualProtect ReadFile FindFirstFileW GetCommandLineW FindNextFileW GetCurrentProcess WriteFile GetModuleFileNameW GetTempPathW FindClose WaitForSingleObject CreateFileW GetFileAttributesW GetModuleHandleA CreateToolhelp32Snapshot MultiByteToWideChar GetTickCount64 Process32NextW GetDiskFreeSpaceExW DeleteFileW Process32FirstW CloseHandle GetSystemInfo LoadLibraryW GetProcAddress LocalFree MoveFileExW GetFileSize GetComputerNameW GetCurrentProcessId GlobalMemoryStatusEx CreateProcessW GetModuleHandleW CopyFileW WideCharToMultiByte GetConsoleWindow GetTickCount IsDebuggerPresent FlsFree WriteConsoleW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo QueryPerformanceCounter WakeAllConditionVariable GetSystemTimeAsFileTime GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue RtlUnwind

iphlpapi

GetAdaptersAddresses

Name

.text

Size

324KB

Virtual Size

323KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

110KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-03_5d2ab6b77987597b4f811dd856f42bb4_cobalt-strike_icedid_luca-stealer_njrat_stealc

crypt32

advapi32

shlwapi

user32

bcrypt

gdi32

ole32

shell32

gdiplus

kernel32

iphlpapi

generic