2026-08-04_6b44c9d237fb45e59e4392194e208034_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_6b44c9d237fb45e59e4392194e208034_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 274KB
Sample260804-hp67katcrf
SHA256 f4e40b9d88807cb92ff743554501d6af06fbdc2141080d3dc94da44553528c50
MD5 6b44c9d237fb45e59e4392194e208034
SHA1 5c2f4eaae2e39c46911ec10720614b4846730d52
SHA512 396a468619bc8ca2b76b49de5500a51a5a52756d8035d0d9808d5e6d4e1732a491e288993464fe66f63376085f84942d52409edf5cbec39ba8d8e9014ea374a8
SSDEEP 3072:ZIonpc4VlAOBBvWQtePByhTdIhiYLo1ReJ12DxkGrcJWYk+xJ7S:tbAOBBOQteP4ldK7TLz
TLSH
T127548D1AB7A50CF9E977C53DCD524902EB72BC4647A0E68F53D00A961F236E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_6b44c9d237fb45e59e4392194e208034_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-04_6b44c9d237fb45e59e4392194e208034_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 274KB

2026-08-04_6b44c9d237fb45e59e4392194e208034_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 4d1e2a6b1e99e68c83b70645c9287d63
SHA256 f4e40b9d88807cb92ff743554501d6af06fbdc2141080d3dc94da44553528c50
MD5 6b44c9d237fb45e59e4392194e208034
SHA1 5c2f4eaae2e39c46911ec10720614b4846730d52
SHA512 396a468619bc8ca2b76b49de5500a51a5a52756d8035d0d9808d5e6d4e1732a491e288993464fe66f63376085f84942d52409edf5cbec39ba8d8e9014ea374a8
SSDEEP 3072:ZIonpc4VlAOBBvWQtePByhTdIhiYLo1ReJ12DxkGrcJWYk+xJ7S:tbAOBBOQteP4ldK7TLz
TLSH
T127548D1AB7A50CF9E977C53DCD524902EB72BC4647A0E68F53D00A961F236E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\A7wSK\source\MalwareProject\A7wSK RAT\x64\Release\Chaos.pdb

kernel32

FreeLibrary GetNativeSystemInfo CloseHandle LoadLibraryA GetLastError GetCurrentProcess WriteConsoleW CreateFileW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LocalFree MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW DuplicateHandle CreateProcessW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType WaitForSingleObject GetExitCodeProcess GetFileAttributesExW CreatePipe FlushFileBuffers GetConsoleOutputCP RtlUnwind

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA AllocateAndInitializeSid GetUserNameA OpenProcessToken FreeSid GetTokenInformation CheckTokenMembership

ole32

CoUninitialize CoSetProxyBlanket CoInitializeSecurity CoInitializeEx CoCreateInstance CoInitialize

oleaut32

VariantClear SysAllocString SysFreeString

ws2_32

freeaddrinfo inet_ntop recv connect closesocket getaddrinfo WSAStartup send socket

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_6b44c9d237fb45e59e4392194e208034_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

ole32

oleaut32

ws2_32

generic