2026-08-12_9e1b14eb47de63b481f40920f57a1195_cobalt-strike_icedid_luca-stealer_njrat_stealc

General

Target
2026-08-12_9e1b14eb47de63b481f40920f57a1195_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 322KB
Sample260812-lt84hatfme
SHA256 18820dbe65fc86c90f3afc2891bd9aca73b2047246df16a088444cbe6b79a153
MD5 9e1b14eb47de63b481f40920f57a1195
SHA1 be5a4cfbe08a407bb91bfad581a73209d72b92f0
SHA512 8b712182d8295efa93e0c621e0aead200c579cb3088e96abf4f8a8a20eaaaf59ca8ab9a20dcbe65656d13b1dd74919413eff7d5f622fbb807fe1b25bc449ffc5
SSDEEP 6144:sCI8g9Uw4049TvlTOnN9qZJe6qAwEzH3SVNn:sWLlT89l6HwEzXSf
TLSH
T177648E16E3B514EDD1378D78C9135527EAF2F88603A599DF07D0AE731B27AA08A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-12_9e1b14eb47de63b481f40920f57a1195_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-12_9e1b14eb47de63b481f40920f57a1195_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 322KB

2026-08-12_9e1b14eb47de63b481f40920f57a1195_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 42bde5ee99cf28eea714fa0a84425259
SHA256 18820dbe65fc86c90f3afc2891bd9aca73b2047246df16a088444cbe6b79a153
MD5 9e1b14eb47de63b481f40920f57a1195
SHA1 be5a4cfbe08a407bb91bfad581a73209d72b92f0
SHA512 8b712182d8295efa93e0c621e0aead200c579cb3088e96abf4f8a8a20eaaaf59ca8ab9a20dcbe65656d13b1dd74919413eff7d5f622fbb807fe1b25bc449ffc5
SSDEEP 6144:sCI8g9Uw4049TvlTOnN9qZJe6qAwEzH3SVNn:sWLlT89l6HwEzXSf
TLSH
T177648E16E3B514EDD1378D78C9135527EAF2F88603A599DF07D0AE731B27AA08A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

137436

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetEnvironmentStringsW GetModuleHandleW WriteConsoleW CreateFileW CloseHandle GetConsoleMode GetConsoleOutputCP FlushFileBuffers QueryPerformanceCounter QueryPerformanceFrequency WideCharToMultiByte InitializeCriticalSectionEx GetSystemTimeAsFileTime GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar GetStringTypeW GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId InitializeSListHead GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapReAlloc HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW FreeEnvironmentStringsW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize

user32

MessageBoxW MessageBoxA

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-12_9e1b14eb47de63b481f40920f57a1195_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

ntdll

generic