2026-08-09_c3b2e38a528a829c8bb36432590e7bfd_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_c3b2e38a528a829c8bb36432590e7bfd_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 213KB
Sample260809-21mf3seq7z
SHA256 b3004ef86770969c02c928ce8af63cb7efcad4374313d3661544edc9ee14d4fc
MD5 c3b2e38a528a829c8bb36432590e7bfd
SHA1 6d0674ef8ea2e758f8b1a3ccc2171d8f27f590fa
SHA512 20c7152d723a1d2c5fa8483882dc894a60deb55e767d540dae64b35aa5c16305f2b3b7124c754919be4a7bbf2a99fb130f2286d6055ac6f4f0ce361a71c860fc
SSDEEP 3072:nZPZlXh6+gsYH8UEgUglyuEoKivkMGdFE8i7TcfrsZypKK/VdXBjUJjI:no8U3hlH8JhuPcfrsU3UJj
TLSH
T17B249D59B7A500F9E877C139CD531A42E6B27805176096DF03A0037AEF6F7E0993EB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_c3b2e38a528a829c8bb36432590e7bfd_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-09_c3b2e38a528a829c8bb36432590e7bfd_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 213KB

2026-08-09_c3b2e38a528a829c8bb36432590e7bfd_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 7158e5aa974ecaab7bb4f15af1a62e61
SHA256 b3004ef86770969c02c928ce8af63cb7efcad4374313d3661544edc9ee14d4fc
MD5 c3b2e38a528a829c8bb36432590e7bfd
SHA1 6d0674ef8ea2e758f8b1a3ccc2171d8f27f590fa
SHA512 20c7152d723a1d2c5fa8483882dc894a60deb55e767d540dae64b35aa5c16305f2b3b7124c754919be4a7bbf2a99fb130f2286d6055ac6f4f0ce361a71c860fc
SSDEEP 3072:nZPZlXh6+gsYH8UEgUglyuEoKivkMGdFE8i7TcfrsZypKK/VdXBjUJjI:no8U3hlH8JhuPcfrsU3UJj
TLSH
T17B249D59B7A500F9E877C139CD531A42E6B27805176096DF03A0037AEF6F7E0993EB62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\krmv\Desktop\Andromeda-CS2-Base-master\velocity-fixed-main\spf\injector\x64\Release\injector.pdb

kernel32

Process32First OpenProcess CreateToolhelp32Snapshot Sleep Process32Next CloseHandle WriteProcessMemory RtlAddFunctionTable GetLastError LoadLibraryA VirtualProtectEx GetProcAddress VirtualAllocEx ReadProcessMemory CreateRemoteThread VirtualFreeEx GetExitCodeProcess GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentProcess TerminateProcess

msvcp140

?good@ios_base@std@@QEBA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception _CxxThrowException memset __std_terminate __std_exception_copy __std_exception_destroy memcpy __C_specific_handler memmove

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf _set_fmode __p__commode

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit __p___argv _initialize_onexit_table _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _register_onexit_function _register_thread_local_exe_atexit_callback terminate _invoke_watson system _crt_atexit __p___argc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_c3b2e38a528a829c8bb36432590e7bfd_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

generic