2026-08-08_b3679cd2b434f509ea7705bff2610891_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-08_b3679cd2b434f509ea7705bff2610891_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 640KB
Sample260808-lses9sdj3t
SHA256 6eef4054d597c0a5b93f110363f760aa98e5679ee61cdfeb57aeee5f63056322
MD5 b3679cd2b434f509ea7705bff2610891
SHA1 2a0198e88a17f2ccc98c1047412234d7dfb71c88
SHA512 8418e5f28751af72ef130d34770beb32b7d1970913ba5c7f13eaf087500803b19ceb117bd15edfdf75e30841d7490c44b621c543263c0086493915129851b17f
SSDEEP 12288:ICkSTfwTjjwlisgTTd+KCJnSsFTcOFP6sTIdx7CV:IpSTfS/wl5gTQ9JnSQYYCsTI+
TLSH
T133D46C26578405FCE1B7C139CE468922F772780A07B1AAEF17D04A925F2B6E45F3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_b3679cd2b434f509ea7705bff2610891_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-08_b3679cd2b434f509ea7705bff2610891_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 640KB

2026-08-08_b3679cd2b434f509ea7705bff2610891_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 97c2d4c60175374bdd3b0d0d602239d4
SHA256 6eef4054d597c0a5b93f110363f760aa98e5679ee61cdfeb57aeee5f63056322
MD5 b3679cd2b434f509ea7705bff2610891
SHA1 2a0198e88a17f2ccc98c1047412234d7dfb71c88
SHA512 8418e5f28751af72ef130d34770beb32b7d1970913ba5c7f13eaf087500803b19ceb117bd15edfdf75e30841d7490c44b621c543263c0086493915129851b17f
SSDEEP 12288:ICkSTfwTjjwlisgTTd+KCJnSsFTcOFP6sTIdx7CV:IpSTfS/wl5gTQ9JnSQYYCsTI+
TLSH
T133D46C26578405FCE1B7C139CE468922F772780A07B1AAEF17D04A925F2B6E45F3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

296828

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpOpen WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpSetTimeouts

ws2_32

accept bind closesocket connect htonl htons listen recv send setsockopt socket WSAStartup WSAGetLastError inet_pton

secur32

AcquireCredentialsHandleW FreeCredentialsHandle InitializeSecurityContextW DecryptMessage EncryptMessage FreeContextBuffer QueryContextAttributesW DeleteSecurityContext AcceptSecurityContext

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptEncrypt BCryptDestroyKey BCryptCreateHash BCryptHashData BCryptFinishHash BCryptDestroyHash BCryptGenRandom

crypt32

PFXExportCertStore PFXImportCertStore CryptBinaryToStringA CryptStringToBinaryA CertCreateSelfSignCertificate CertStrToNameA CryptImportPublicKeyInfoEx2 CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CertOpenStore CryptDecodeObjectEx

advapi32

CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW QueryServiceStatus OpenServiceW OpenSCManagerW ControlService CloseServiceHandle RegQueryValueExW RegOpenKeyExW RegCloseKey

user32

GetSystemMetrics

kernel32

ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree GetConsoleMode GetCommandLineA FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect GetFileSizeEx SetFilePointerEx ReadConsoleW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW SetEndOfFile GetCommandLineW HeapAlloc HeapFree HeapReAlloc WaitForSingleObject CreateProcessW GetFileAttributesExW GetTimeZoneInformation GetFileType GetConsoleOutputCP QueryPerformanceFrequency TlsSetValue TlsGetValue GetStdHandle CreateFileA CreateFileW FindClose FindFirstFileW FindNextFileW GetVolumeInformationW ReadFile WriteFile OutputDebugStringA CloseHandle GetLastError ConnectNamedPipe PeekNamedPipe CreateNamedPipeW DeviceIoControl Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess GetSystemInfo GetSystemTime GetSystemDirectoryW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetProcAddress LocalFree GetComputerNameW SetConsoleCtrlHandler FillConsoleOutputCharacterA FillConsoleOutputAttribute GetConsoleScreenBufferInfo SetConsoleScreenBufferSize SetConsoleCursorPosition SetConsoleTextAttribute SetConsoleWindowInfo SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW QueryPerformanceCounter TlsAlloc WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime GetModuleHandleW WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer CompareStringEx MultiByteToWideChar GetCPInfo LCMapStringEx GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead InitializeCriticalSectionAndSpinCount FlsFree FlsSetValue FlsGetValue RaiseException SetLastError FlsAlloc

ntdll

RtlUnwindEx RtlUnwind RtlPcToFileHeader

Name

.text

Size

475KB

Virtual Size

475KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-08_b3679cd2b434f509ea7705bff2610891_cobalt-strike_icedid_luca-stealer_njrat_stealc

winhttp

ws2_32

secur32

bcrypt

crypt32

advapi32

user32

kernel32

ntdll

generic