2026-08-11_0c7507988f9ce7dc8bd8fa63432f40ef_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-11_0c7507988f9ce7dc8bd8fa63432f40ef_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 750KB
Sample260811-a3s8vsbe95
SHA256 6820cfa26f3850f865e7c8a14d0b36b49c7223bccad1cfc9fcd5d40da0277353
MD5 0c7507988f9ce7dc8bd8fa63432f40ef
SHA1 e275aa8005a7983b42367db22d67f975721ae804
SHA512 49c35ef3083d3e4824bba75121c03cdc8898f7605267b1824755d563c6ebfa52c68cebcee4416e83f335cee1a4f92837c4fec1c132753ecb4517f397a2059b11
SSDEEP 12288:cSoHC9RebLjray/N9tAq5bLbaDbV/VA1m1P3R9fW9ah:cbHkR2LjrDTm1PhNH
TLSH
T105F46C27A38401FDE0B6D27A8E868955F732B80A07E16ACF17D045625F9B1D89F3E713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-11_0c7507988f9ce7dc8bd8fa63432f40ef_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-11_0c7507988f9ce7dc8bd8fa63432f40ef_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 750KB

2026-08-11_0c7507988f9ce7dc8bd8fa63432f40ef_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 1ad646f25d775e508cfb7b5f968dded3
SHA256 6820cfa26f3850f865e7c8a14d0b36b49c7223bccad1cfc9fcd5d40da0277353
MD5 0c7507988f9ce7dc8bd8fa63432f40ef
SHA1 e275aa8005a7983b42367db22d67f975721ae804
SHA512 49c35ef3083d3e4824bba75121c03cdc8898f7605267b1824755d563c6ebfa52c68cebcee4416e83f335cee1a4f92837c4fec1c132753ecb4517f397a2059b11
SSDEEP 12288:cSoHC9RebLjray/N9tAq5bLbaDbV/VA1m1P3R9fW9ah:cbHkR2LjrDTm1PhNH
TLSH
T105F46C27A38401FDE0B6D27A8E868955F732B80A07E16ACF17D045625F9B1D89F3E713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

317208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmSetWindowAttribute

advapi32

RegOpenKeyExW RegSetValueExA OpenProcessToken GetTokenInformation RegCloseKey RegCreateKeyExW RegDeleteValueA RegQueryValueExW RegSetValueExW RegQueryValueExA

winhttp

WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryDataAvailable WinHttpReadData WinHttpSetTimeouts WinHttpOpenRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpAddRequestHeaders WinHttpSendRequest

bcrypt

BCryptCreateHash BCryptDestroySecret BCryptDestroyKey BCryptFinalizeKeyPair BCryptImportKeyPair BCryptHashData BCryptDecrypt BCryptGenerateKeyPair BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGetProperty BCryptOpenAlgorithmProvider BCryptDeriveKey BCryptFinishHash BCryptDestroyHash BCryptSecretAgreement BCryptExportKey

shell32

CommandLineToArgvW ShellExecuteW ShellExecuteExW Shell_NotifyIconW SHFileOperationW SHCreateItemFromParsingName SHGetKnownFolderPath SHGetFolderPathW

ole32

CoTaskMemAlloc CoCreateInstance CoUninitialize CoTaskMemFree CoInitializeEx

user32

SetWindowLongPtrW GetWindowLongPtrW SetWindowLongW GetWindowLongW GetCursorPos MessageBoxW AdjustWindowRect GetWindowRect GetClientRect SetWindowTextW SetForegroundWindow UpdateWindow TrackPopupMenu ChangeWindowMessageFilterEx DestroyMenu CreatePopupMenu GetSystemMetrics GetParent SetFocus IsWindowVisible SetWindowPos MoveWindow ShowWindow DestroyWindow IsWindow CreateWindowExW RegisterClassExW CallWindowProcW PostQuitMessage DefWindowProcW PostMessageW SendMessageW DispatchMessageW TranslateMessage GetMessageW RegisterWindowMessageW FindWindowW GetAsyncKeyState LoadImageW AppendMenuW

shlwapi

PathCombineW PathFindFileNameW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

kernel32

GetExitCodeProcess WriteConsoleW HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx GetFileType LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer SetLastError RtlUnwindEx InitializeSListHead TerminateProcess IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetSystemTimeAsFileTime InitializeCriticalSectionEx WakeAllConditionVariable RaiseException RtlPcToFileHeader GetCommandLineW SetEnvironmentVariableW GetFileAttributesW CloseHandle GetLastError WaitForSingleObject CreateMutexW Sleep GetCurrentProcess GetCurrentProcessId GetCurrentThreadId CreateProcessW FreeLibrary GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryW LocalFree lstrcmpW MultiByteToWideChar WideCharToMultiByte WinExec CreateFileW ReadFile WriteFile PeekNamedPipe GetEnvironmentVariableW CreateDirectoryW DeleteFileW GetFileSizeEx SetFileAttributesW GetTempPathW QueryPerformanceCounter OpenProcess GetTickCount64 CopyFileW GetComputerNameW IsDebuggerPresent GetVolumeInformationW SleepConditionVariableSRW QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive

Name

.text

Size

405KB

Virtual Size

405KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

173KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

51KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-11_0c7507988f9ce7dc8bd8fa63432f40ef_cobalt-strike_icedid_luca-stealer_njrat_stealc

dwmapi

advapi32

winhttp

bcrypt

shell32

ole32

user32

shlwapi

version

kernel32

generic