2026-08-07_386b8899c934d8b9cc64f5171596e73d_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-07_386b8899c934d8b9cc64f5171596e73d_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 762KB
Sample260808-byq4daxemf
SHA256 4f9be467e4933b06369fd6b52faad7c97d0e29bfab9ca7cd7ba387b7798c5161
MD5 386b8899c934d8b9cc64f5171596e73d
SHA1 4186f792fff5817d41c58e0987f47daa4b0d7e96
SHA512 5bab18d13b4c777c66f5e32786b93264948b15dc38422e19bf62ad22d884ff8989d86db13a017b6ec70e71386613b54aaf1cc540964110221797549226243a44
SSDEEP 12288:jmtIn6EAPRgZdI1vE1f/mJDO9f578beb3GTVHVgfk1P3R9fW9ah:jmtIn+2ZdI1vE1f/Xk1PhNH
TLSH
T103F45D17938041FDE0BAD27A8E968961F732F80A07A16ADF17D045621F9B1D89F3E713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-07_386b8899c934d8b9cc64f5171596e73d_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-07_386b8899c934d8b9cc64f5171596e73d_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 762KB

2026-08-07_386b8899c934d8b9cc64f5171596e73d_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH b0ab5775717928b1925d9d82d94777b0
SHA256 4f9be467e4933b06369fd6b52faad7c97d0e29bfab9ca7cd7ba387b7798c5161
MD5 386b8899c934d8b9cc64f5171596e73d
SHA1 4186f792fff5817d41c58e0987f47daa4b0d7e96
SHA512 5bab18d13b4c777c66f5e32786b93264948b15dc38422e19bf62ad22d884ff8989d86db13a017b6ec70e71386613b54aaf1cc540964110221797549226243a44
SSDEEP 12288:jmtIn6EAPRgZdI1vE1f/mJDO9f578beb3GTVHVgfk1P3R9fW9ah:jmtIn+2ZdI1vE1f/Xk1PhNH
TLSH
T103F45D17938041FDE0BAD27A8E968961F732F80A07A16ADF17D045621F9B1D89F3E713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

325272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmSetWindowAttribute

advapi32

RegOpenKeyExW RegSetValueExA OpenProcessToken GetTokenInformation RegCloseKey RegCreateKeyExW RegDeleteValueA RegQueryValueExW RegSetValueExW RegQueryValueExA

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryDataAvailable WinHttpReadData WinHttpSetTimeouts WinHttpOpenRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpSendRequest

bcrypt

BCryptCreateHash BCryptDestroySecret BCryptDestroyKey BCryptFinalizeKeyPair BCryptImportKeyPair BCryptHashData BCryptDecrypt BCryptGenerateKeyPair BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty BCryptOpenAlgorithmProvider BCryptDeriveKey BCryptFinishHash BCryptDestroyHash BCryptSecretAgreement BCryptExportKey

shell32

CommandLineToArgvW ShellExecuteW ShellExecuteExW Shell_NotifyIconW SHFileOperationW SHCreateItemFromParsingName SHGetKnownFolderPath SHGetFolderPathW

ole32

CoTaskMemAlloc CoCreateInstance CoUninitialize CoTaskMemFree CoInitializeEx

user32

SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW GetWindowLongW GetCursorPos MessageBoxW AdjustWindowRect GetWindowRect GetClientRect SetWindowTextW SetForegroundWindow UpdateWindow TrackPopupMenu ChangeWindowMessageFilterEx DestroyMenu CreatePopupMenu GetSystemMetrics GetParent SetFocus IsWindowVisible SetWindowPos MoveWindow ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW CallWindowProcW PostQuitMessage DefWindowProcW PostMessageW SendMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW FindWindowW GetAsyncKeyState LoadImageW AppendMenuW

shlwapi

PathCombineW PathFindFileNameW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

kernel32

ReadFile WriteConsoleW HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW SetFilePointerEx GetFileType LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError RtlUnwindEx InitializeSListHead TerminateProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetSystemTimeAsFileTime InitializeCriticalSectionEx WakeAllConditionVariable RaiseException RtlPcToFileHeader SleepConditionVariableSRW TryAcquireSRWLockExclusive GetCommandLineW SetEnvironmentVariableW GetFileAttributesW CloseHandle GetLastError WaitForSingleObject CreateMutexW Sleep GetCurrentProcess GetCurrentProcessId GetCurrentThreadId CreateProcessW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryW LocalFree lstrcmpW MultiByteToWideChar WideCharToMultiByte GetExitCodeProcess WinExec CreateFileW WriteFile PeekNamedPipe GetEnvironmentVariableW CreateDirectoryW DeleteFileW GetFileSizeEx SetFileAttributesW SetFileInformationByHandle GetTempPathW QueryPerformanceCounter OpenProcess GetTickCount64 CopyFileW MoveFileExW GetComputerNameW FindClose FindFirstFileW FindNextFileW IsDebuggerPresent CheckRemoteDebuggerPresent CreateToolhelp32Snapshot Process32FirstW Process32NextW GetVolumeInformationW QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive

Name

.text

Size

413KB

Virtual Size

413KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

51KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-07_386b8899c934d8b9cc64f5171596e73d_cobalt-strike_icedid_luca-stealer_njrat_stealc

dwmapi

advapi32

winhttp

bcrypt

shell32

ole32

user32

shlwapi

version

kernel32

generic