Extracted

• • Target
    2026-08-14_65a7c9e1fe038bdf2a6b9fad27b4bea1_cobalt-strike_icedid_luca-stealer_njrat
  • Size 153KB
  • SHA256 94b437a1e9912c34df297b8814402ec79e49258c8ef2aa2838d6270d05de9d87
  • MD5 65a7c9e1fe038bdf2a6b9fad27b4bea1
  • SHA1 9681a0e9cf434082df6c30feacd0d2875605becc
  • SHA512 72d13e5854e648e127cb7a71956616410176c8f36278dcbdc5deab8783a7f8cc04b86ee06ba960e04b02734d32cf29b9d5d2fe06de56df85b200da11a054d0f5
  • SSDEEP 1536:EwXIaWlak1Sx9BmvksTVAajuROrBC9IuGVtLTH7S8vTq3VRuPt9Ugh2mwAQsWWdj:EGX3ApS4BC9uFbroVRuP5LB1VUbTRfE
  • TLSH
    T1F8E35C5773E570F9E1B38274C9A58566E772BC320B209BDF03A446762F236D09D3AB21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutionpersistencespywarestealer

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Uses browser remote debugging

    Can be used to control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2