2026-08-09_e955c1e6a323e0ad96c6da923dcb76cb_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-09_e955c1e6a323e0ad96c6da923dcb76cb_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 861KB
Sample260809-s8k4jshm3x
SHA256 bbfa20bce37dad1c36f5834a655da97b0c76669c1cad6580adf0a13e60ae11de
MD5 e955c1e6a323e0ad96c6da923dcb76cb
SHA1 e3fca16a201c31d40ba7fe991ac292ac87e26fe6
SHA512 6618514e8c091cd97f0e449c7854e39cb79302ebe6d6aa6fa128d8cc7522b4f824897caf3bdf179adf4f1a9d63847f6325cb47229ffbd2884eaf65a0a5350f78
SSDEEP 12288:5676trLM7JOj2XNtrgn2BjsIBowD840H4RJLJPiCcnxo484/+:y6trL5j2XNjD840W9ivnxt
TLSH
T1A2159E59B2E500F8E0BB9574D9A5622BE67678161B3086DF03D0066C7F737E04AB7B23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_e955c1e6a323e0ad96c6da923dcb76cb_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-09_e955c1e6a323e0ad96c6da923dcb76cb_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 861KB

2026-08-09_e955c1e6a323e0ad96c6da923dcb76cb_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 727a768a837283847f4e05ecdd13d8eb
SHA256 bbfa20bce37dad1c36f5834a655da97b0c76669c1cad6580adf0a13e60ae11de
MD5 e955c1e6a323e0ad96c6da923dcb76cb
SHA1 e3fca16a201c31d40ba7fe991ac292ac87e26fe6
SHA512 6618514e8c091cd97f0e449c7854e39cb79302ebe6d6aa6fa128d8cc7522b4f824897caf3bdf179adf4f1a9d63847f6325cb47229ffbd2884eaf65a0a5350f78
SSDEEP 12288:5676trLM7JOj2XNtrgn2BjsIBowD840H4RJLJPiCcnxo484/+:y6trL5j2XNjD840W9ivnxt
TLSH
T1A2159E59B2E500F8E0BB9574D9A5622BE67678161B3086DF03D0066C7F737E04AB7B23
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

454756

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d9

Direct3DCreate9

dwmapi

DwmExtendFrameIntoClientArea

user32

TranslateMessage LoadCursorA ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard MessageBoxW GetClientRect UpdateWindow GetSystemMetrics mouse_event GetAsyncKeyState SetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PeekMessageW DispatchMessageW

kernel32

FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers OutputDebugStringW LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc WriteFile CloseHandle Sleep OpenProcess GetTickCount SetEnvironmentVariableW GetModuleHandleW AllocConsole FreeConsole CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetProcAddress LoadLibraryA GetLocaleInfoA IsDBCSLeadByte ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead ExitProcess ReadFile WriteConsoleW GetProcessHeap SetStdHandle GetStringTypeW HeapSize CreateFileW HeapReAlloc SetEndOfFile ReadProcessMemory GetCurrentProcess RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW

shell32

ShellExecuteW

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

Name

.text

Size

621KB

Virtual Size

620KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

204KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_e955c1e6a323e0ad96c6da923dcb76cb_cobalt-strike_icedid_luca-stealer_njrat_stealc

d3d9

dwmapi

user32

kernel32

shell32

imm32

generic