2026-08-04_2ff14f12a5acd58e756cfec9d4730efa_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_2ff14f12a5acd58e756cfec9d4730efa_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 479KB
Sample260804-jpw72aam3v
SHA256 bf671700b70f29e80c2271b55e66c12809232abe9c56d4a467caa60d50f77db1
MD5 2ff14f12a5acd58e756cfec9d4730efa
SHA1 ff4f6f2395070ee9aac3ae891613c1a8edcd94e8
SHA512 bf75956fc9a5e60ff25a2f86889f30d564eb7bcfed4681325dbce39fbf12a490ef98712d4ebca7a2191a347061542689930e594abfcfbfe267f70d30403ba6a2
SSDEEP 6144:S1QgrTZu458LqcWAv3R7TNrqZlDvtN2VeQ571GUBzesJJCnYrItZspXJOfQXvtE/:4X8PWAv3Kztq/RtewVEzsufQXvtk
TLSH
T13AA45E19A69802F9E1B7C179CAD64C06F772780A0770EEDF03948A765F276D04E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing possible sandbox analysis VM names 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxComputerNames

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Detects executables containing possible sandbox system UUIDs 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxSystemUUIDs

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_2ff14f12a5acd58e756cfec9d4730efa_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-04_2ff14f12a5acd58e756cfec9d4730efa_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 479KB

2026-08-04_2ff14f12a5acd58e756cfec9d4730efa_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH cba42e6c49036c90d1a73cc20ad5da36
SHA256 bf671700b70f29e80c2271b55e66c12809232abe9c56d4a467caa60d50f77db1
MD5 2ff14f12a5acd58e756cfec9d4730efa
SHA1 ff4f6f2395070ee9aac3ae891613c1a8edcd94e8
SHA512 bf75956fc9a5e60ff25a2f86889f30d564eb7bcfed4681325dbce39fbf12a490ef98712d4ebca7a2191a347061542689930e594abfcfbfe267f70d30403ba6a2
SSDEEP 6144:S1QgrTZu458LqcWAv3R7TNrqZlDvtN2VeQ571GUBzesJJCnYrItZspXJOfQXvtE/:4X8PWAv3Kztq/RtewVEzsufQXvtk
TLSH
T13AA45E19A69802F9E1B7C179CAD64C06F772780A0770EEDF03948A765F276D04E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing possible sandbox analysis VM names
Detects executables containing possible sandbox analysis VM usernames
Detects executables containing possible sandbox system UUIDs
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

183880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

crypt32

CryptUnprotectData CryptStringToBinaryA

advapi32

GetUserNameW SetEntriesInAclW SetNamedSecurityInfoW RegQueryValueExW RegCloseKey RegOpenKeyExW

shlwapi

PathFindFileNameW PathFindExtensionW

user32

GetSystemMetrics GetDC ReleaseDC ShowWindow

bcrypt

BCryptGenerateSymmetricKey BCryptDestroyKey BCryptGetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty

gdi32

DeleteDC CreateCompatibleDC SelectObject BitBlt CreateCompatibleBitmap DeleteObject

ole32

CreateStreamOnHGlobal CoUninitialize CoInitialize CLSIDFromString

shell32

SHGetFolderPathW

gdiplus

GdipFree GdiplusShutdown GdipCloneImage GdipAlloc GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipSaveImageToStream GdiplusStartup

kernel32

GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW SetFilePointerEx GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW HeapSize VirtualProtect GetSystemFirmwareTable ReadFile FindFirstFileW GetCommandLineW FindNextFileW GetCurrentProcess WriteFile TerminateProcess GetModuleFileNameW SetFilePointer GetTempPathW FindClose WaitForSingleObject CreateFileW GetFileAttributesW GetSystemDirectoryW GetModuleHandleA OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar GetTickCount64 Process32NextW GetDiskFreeSpaceExW DeleteFileW Process32FirstW CloseHandle GetSystemInfo LoadLibraryW GetProcAddress LocalFree MoveFileExW GetFileSize GetComputerNameW GlobalMemoryStatusEx CreateProcessW GetModuleHandleW CopyFileW WideCharToMultiByte GetConsoleWindow GetTickCount IsDebuggerPresent FlsFree WriteConsoleW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread LCMapStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo QueryPerformanceCounter WakeAllConditionVariable GetSystemTimeAsFileTime GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue RtlUnwind

iphlpapi

GetAdaptersAddresses

Name

.text

Size

335KB

Virtual Size

335KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

117KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-04_2ff14f12a5acd58e756cfec9d4730efa_cobalt-strike_icedid_luca-stealer_njrat_stealc

crypt32

advapi32

shlwapi

user32

bcrypt

gdi32

ole32

shell32

gdiplus

kernel32

iphlpapi

generic