2026-08-20_5dab64d9f63eae230a1d4f45aac51308_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_5dab64d9f63eae230a1d4f45aac51308_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 262KB
Sample260820-pwpz7axcma
SHA256 3fd59a64ac0ef83934f9fddefa0311a35265afcf944d53f6caf21278920301ac
MD5 5dab64d9f63eae230a1d4f45aac51308
SHA1 78a7648817c1e8bdaadcebac8fe364d98e54858e
SHA512 0d9d4a6bfd0b7d34b8a1d4a32de12fc9f62be9ee24fdcdae9bd8c736c34857ff4d74a32d1205cae1f4ecb918e0e09767cdb085e7a3fe830da3f210971512d31e
SSDEEP 3072:CCkfk/4R+C/d/B3JFNJY1Jz+lAeo0j9Whb7BiIm5zsLfF1o/WVYXMVkDjvnInx5K:5kfk/4R+31JI73jghb781XYch
TLSH
T169447D15B7A50CFAED77C53DCD428905EA727C464760EACB03A04AA71F276E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_5dab64d9f63eae230a1d4f45aac51308_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-20_5dab64d9f63eae230a1d4f45aac51308_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 262KB

2026-08-20_5dab64d9f63eae230a1d4f45aac51308_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 7bc9617d9f4a71d3ccee2bf80033b0cd
SHA256 3fd59a64ac0ef83934f9fddefa0311a35265afcf944d53f6caf21278920301ac
MD5 5dab64d9f63eae230a1d4f45aac51308
SHA1 78a7648817c1e8bdaadcebac8fe364d98e54858e
SHA512 0d9d4a6bfd0b7d34b8a1d4a32de12fc9f62be9ee24fdcdae9bd8c736c34857ff4d74a32d1205cae1f4ecb918e0e09767cdb085e7a3fe830da3f210971512d31e
SSDEEP 3072:CCkfk/4R+C/d/B3JFNJY1Jz+lAeo0j9Whb7BiIm5zsLfF1o/WVYXMVkDjvnInx5K:5kfk/4R+31JI73jghb781XYch
TLSH
T169447D15B7A50CFAED77C53DCD428905EA727C464760EACB03A04AA71F276E09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLastError Process32NextW Process32FirstW CloseHandle GetProcAddress VirtualAllocEx GetModuleHandleW CreateRemoteThread VirtualFreeEx SetEndOfFile WriteConsoleW HeapSize CreateFileW GetExitCodeThread GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose CreateToolhelp32Snapshot OpenProcess GetFileAttributesW WaitForSingleObject SetStdHandle WriteProcessMemory EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapFree HeapAlloc GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc RtlUnwind

user32

GetMessageW DefWindowProcW UnregisterHotKey CreateWindowExW SendMessageW SetWindowTextW RegisterClassExW GetWindowTextLengthW DispatchMessageW RegisterHotKey TranslateMessage LoadIconW LoadCursorW PostQuitMessage UpdateWindow GetWindowTextW ShowWindow

comctl32

InitCommonControlsEx

comdlg32

GetOpenFileNameW

gdi32

GetStockObject

Name

.text

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_5dab64d9f63eae230a1d4f45aac51308_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

user32

comctl32

comdlg32

gdi32

generic