2026-08-07_b7c93119cf0fd58c30de5e8cf58bad46_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-08-07_b7c93119cf0fd58c30de5e8cf58bad46_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 327KB
Sample260807-lxflcsfb55
SHA256 f5203cae5c9394fc329bd296a61fdcd039baaa1ad18d4a49b21af8915df9e20c
MD5 b7c93119cf0fd58c30de5e8cf58bad46
SHA1 f615ba3971ba9f02b11b5bba51f71d9a33b46452
SHA512 2b96508b929159e2da0592664163a5a358f241865ef964f677805b1782eacef58efec9bdefb89cee0abce1864581f2cf2325117d1b2b674ddcf61b65a3951e9a
SSDEEP 6144:gCI8g9Uw4049TvlTOnN9qZJe6qAwv8dSWNZ:gWLlT89l6HwEdSY
TLSH
T1BF647C1AA3B515EDD13B8578C9035517EEF27C4707A0AADF13D08AB21B37EA0963E790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_b7c93119cf0fd58c30de5e8cf58bad46_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-07_b7c93119cf0fd58c30de5e8cf58bad46_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 327KB

2026-08-07_b7c93119cf0fd58c30de5e8cf58bad46_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 42bde5ee99cf28eea714fa0a84425259
SHA256 f5203cae5c9394fc329bd296a61fdcd039baaa1ad18d4a49b21af8915df9e20c
MD5 b7c93119cf0fd58c30de5e8cf58bad46
SHA1 f615ba3971ba9f02b11b5bba51f71d9a33b46452
SHA512 2b96508b929159e2da0592664163a5a358f241865ef964f677805b1782eacef58efec9bdefb89cee0abce1864581f2cf2325117d1b2b674ddcf61b65a3951e9a
SSDEEP 6144:gCI8g9Uw4049TvlTOnN9qZJe6qAwv8dSWNZ:gWLlT89l6HwEdSY
TLSH
T1BF647C1AA3B515EDD13B8578C9035517EEF27C4707A0AADF13D08AB21B37EA0963E790
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

137436

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetEnvironmentStringsW GetModuleHandleW WriteConsoleW CreateFileW CloseHandle GetConsoleMode GetConsoleOutputCP FlushFileBuffers QueryPerformanceCounter QueryPerformanceFrequency WideCharToMultiByte InitializeCriticalSectionEx GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId InitializeSListHead GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapReAlloc HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW FreeEnvironmentStringsW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize

user32

MessageBoxW MessageBoxA

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_b7c93119cf0fd58c30de5e8cf58bad46_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

ntdll

generic