2026-08-09_af258e9ff3e3cfcf60a9bf670a157a39_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-08-09_af258e9ff3e3cfcf60a9bf670a157a39_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 341KB
Sample260809-tmsf6st1at
SHA256 f46d62a1efe2c9f840f1c34ae9fd71b454ef73e2605cf1d3acbde46fe198460c
MD5 af258e9ff3e3cfcf60a9bf670a157a39
SHA1 b0faa3c896147fd40bbe4eb1949699bf0018be24
SHA512 811a0615665570a5e08935e264914aa35a7c16fe77105b92250fc2b2817ca3b159243a2a057c44db89c9d68fa851e291a4fad4ebd24719da63a4a0447145d544
SSDEEP 6144:hjAwYktqtEu+gI+WhEsC+O1DtvTzEs66NL/yE4K:57jcEh8+atvTzN6N7K
TLSH
T151747E2AFBA414F9E177C179CD564905EB727C4A07A0A7CF23904E621F276E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-09_af258e9ff3e3cfcf60a9bf670a157a39_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-09_af258e9ff3e3cfcf60a9bf670a157a39_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 341KB

2026-08-09_af258e9ff3e3cfcf60a9bf670a157a39_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 1bc258ac27e7f7417f6055c4ad913451
SHA256 f46d62a1efe2c9f840f1c34ae9fd71b454ef73e2605cf1d3acbde46fe198460c
MD5 af258e9ff3e3cfcf60a9bf670a157a39
SHA1 b0faa3c896147fd40bbe4eb1949699bf0018be24
SHA512 811a0615665570a5e08935e264914aa35a7c16fe77105b92250fc2b2817ca3b159243a2a057c44db89c9d68fa851e291a4fad4ebd24719da63a4a0447145d544
SSDEEP 6144:hjAwYktqtEu+gI+WhEsC+O1DtvTzEs66NL/yE4K:57jcEh8+atvTzN6N7K
TLSH
T151747E2AFBA414F9E177C179CD564905EB727C4A07A0A7CF23904E621F276E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

82312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\YBS\Downloads\ai developerin kullandigi src\Lefrizzel AI\Loader\x64\Release\LETHA Loader.pdb

dwmapi

DwmSetWindowAttribute

kernel32

GetProcAddress VirtualAllocEx ReadProcessMemory CreateRemoteThread VirtualFreeEx GetExitCodeProcess WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage VirtualProtectEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation HeapAlloc LoadLibraryA RtlAddFunctionTable WriteProcessMemory GetTickCount CloseHandle Process32FirstW Process32NextW GetLastError Sleep CreateToolhelp32Snapshot OpenProcess ReleaseMutex CreateMutexW GetModuleFileNameA SetEndOfFile HeapReAlloc LocalFree FormatMessageA GetLocaleInfoEx CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte GetCurrentThreadId RtlUnwind QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable GetSystemTimeAsFileTime GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ReadFile CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile SetFilePointerEx GetConsoleMode ReadConsoleW GetFileType GetFileSizeEx

user32

GetMessageW DefWindowProcW GetWindowRect SetWindowPos MessageBoxW SetWindowLongPtrW FillRect CreateWindowExW ScreenToClient SendMessageW GetSystemMetrics GetWindowLongPtrW RegisterClassExW ShowWindow IsWindow DispatchMessageW EndPaint SetLayeredWindowAttributes TranslateMessage LoadCursorW GetClientRect DrawTextW KillTimer PostQuitMessage GetParent UpdateWindow ReleaseCapture InvalidateRect GetCursorPos BeginPaint SetTimer

gdi32

BitBlt CreateCompatibleBitmap SelectObject CreateCompatibleDC CreateFontW GetStockObject DeleteDC SetTextColor SetBkMode LineTo CreatePen Rectangle MoveToEx DeleteObject CreateSolidBrush RoundRect

Name

.text

Size

233KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-09_af258e9ff3e3cfcf60a9bf670a157a39_cobalt-strike_icedid_luca-stealer_njrat_stealc

dwmapi

kernel32

user32

gdi32

generic