2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 353KB
Sample260809-hwpk4asgre
SHA256 ceae812b8e9eb004345ed9220be23428e3792e4cbd839702ee0d580c66ec8063
MD5 07aebd83a4b3bfc8bd1a413ff6a419e6
SHA1 c7e040fc67979cb676363a4a550a315ef84e3562
SHA512 f0ff8cd1059a83b7904c06eac4ce46dfb61f15daa1288ea9fb396128a101abe95883ca59611795c0c2a4bded94bb66fba356989b0c1aa29fb51f1bb1f5b1be79
SSDEEP 6144:nemor+ep+ygCo5an+brBsSisTSku03uJH9hJEoha+:JoWbtwsTSksx9hz
TLSH
T1FF747C19F7E510F9E9B7953CCD538546EA727C164760DACF03A08A962F23AD08E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 353KB

2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 92ceebe276067e5fd7ab1e2a9a3f39b9
SHA256 ceae812b8e9eb004345ed9220be23428e3792e4cbd839702ee0d580c66ec8063
MD5 07aebd83a4b3bfc8bd1a413ff6a419e6
SHA1 c7e040fc67979cb676363a4a550a315ef84e3562
SHA512 f0ff8cd1059a83b7904c06eac4ce46dfb61f15daa1288ea9fb396128a101abe95883ca59611795c0c2a4bded94bb66fba356989b0c1aa29fb51f1bb1f5b1be79
SSDEEP 6144:nemor+ep+ygCo5an+brBsSisTSku03uJH9hJEoha+:JoWbtwsTSksx9hz
TLSH
T1FF747C19F7E510F9E9B7953CCD538546EA727C164760DACF03A08A962F23AD08E3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

342528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

TerminateProcess GetModuleFileNameW GetTempPathW WaitForSingleObject CreateFileW SuspendThread ResumeThread UnmapViewOfFile OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetTickCount64 GetLastError Process32NextW Process32FirstW CloseHandle VirtualProtectEx GetThreadContext WriteFile VirtualAllocEx ExitProcess ReadProcessMemory GetCurrentProcessId CreateProcessW GetModuleHandleW QueryFullProcessImageNameW VirtualFreeEx CreateFileMappingW MapViewOfFile SetThreadContext QueryPerformanceCounter GetExitCodeProcess SetEndOfFile WriteConsoleW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW GetCurrentProcess WriteProcessMemory GetProcAddress CreateDirectoryW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW ReadFile GetConsoleMode LocalFree FormatMessageA GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle AreFileApisANSI CopyFileW GetFileInformationByHandleEx WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP RtlUnwind

user32

FindWindowW EnumWindows GetWindowThreadProcessId GetWindowTextW

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

wininet

InternetOpenUrlW InternetReadFile InternetCloseHandle InternetOpenW

dbghelp

SymUnloadModule64 SymFromName SymInitializeW SymLoadModuleExW SymSetOptions SymCleanup

Name

.text

Size

204KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

40KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_07aebd83a4b3bfc8bd1a413ff6a419e6_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

advapi32

wininet

dbghelp

generic