2026-08-20_fc0ae63726140c3c85e7729b3e7c8c29_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-20_fc0ae63726140c3c85e7729b3e7c8c29_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 540KB
Sample260821-ckdfsseq5s
SHA256 25d30b834364f0a3714a441ab2684d37dda5a6dc7e14426ca37bc1abdee8ecfa
MD5 fc0ae63726140c3c85e7729b3e7c8c29
SHA1 eafbfbde50a05e1f0ba3c9bbfdda735442cb8d5a
SHA512 34486f44bf56ec24c9b0e1551a7c550c01c7cafd1c1607d5fb79245734870b147926aa2def32c5f4109872b9492b7ff729a4b87518a988e40fdf696dfa9e5703
SSDEEP 6144:ntj0VPbZMpRpGNd5nUF2b1/CZ17EPZBekZpE4hD+PMM74QJ6+YStE0n14GNIKoH8:tj0VPbPv5R5/+MskSe8PE01YJwbo8Eb
TLSH
T1E6C47B95B2A543F9D1B7C178CA838916E7727C4907759BEB13D08AB21E33AE15E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-20_fc0ae63726140c3c85e7729b3e7c8c29_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-20_fc0ae63726140c3c85e7729b3e7c8c29_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 540KB

2026-08-20_fc0ae63726140c3c85e7729b3e7c8c29_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 2cfc723add0b5c6c10e40243937690e7
SHA256 25d30b834364f0a3714a441ab2684d37dda5a6dc7e14426ca37bc1abdee8ecfa
MD5 fc0ae63726140c3c85e7729b3e7c8c29
SHA1 eafbfbde50a05e1f0ba3c9bbfdda735442cb8d5a
SHA512 34486f44bf56ec24c9b0e1551a7c550c01c7cafd1c1607d5fb79245734870b147926aa2def32c5f4109872b9492b7ff729a4b87518a988e40fdf696dfa9e5703
SSDEEP 6144:ntj0VPbZMpRpGNd5nUF2b1/CZ17EPZBekZpE4hD+PMM74QJ6+YStE0n14GNIKoH8:tj0VPbPv5R5/+MskSe8PE01YJwbo8Eb
TLSH
T1E6C47B95B2A543F9D1B7C178CA838916E7727C4907759BEB13D08AB21E33AE15E3E310
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

241768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\Andromeda-CS2-Base\Andromeda-CS2-Base\x64\Release\PluginSense.pdb

kernel32

HeapAlloc GetFileSize GetProcessHeap Process32Next CreateFileA GetFileAttributesA CloseHandle LCMapStringEx Sleep CreateToolhelp32Snapshot Wow64DisableWow64FsRedirection InitializeCriticalSectionEx Wow64RevertWow64FsRedirection GetLastError DecodePointer DeleteCriticalSection GetSystemTimeAsFileTime QueryPerformanceCounter EnterCriticalSection TerminateProcess LeaveCriticalSection InitializeCriticalSection ResumeThread GetModuleFileNameW GetFileAttributesW MultiByteToWideChar FormatMessageW LocalFree GetModuleHandleW WideCharToMultiByte CreateActCtxW WriteFile GetTempPathW CreateFileW UnmapViewOfFile DeleteFileW GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW GetNativeSystemInfo WaitForSingleObject DuplicateHandle GetCurrentThread ResetEvent GetTickCount DeviceIoControl Thread32Next Thread32First GetCurrentThreadId GetCurrentProcessId GetProcAddress CreateNamedPipeW TerminateThread GetExitCodeThread OpenProcess GetProcessId IsWow64Process GetSystemInfo VirtualAllocEx VirtualFreeEx WriteProcessMemory VirtualProtectEx GetThreadContext ReadProcessMemory CreateRemoteThread SetThreadContext VirtualQueryEx LoadLibraryW FreeLibrary SuspendThread GetThreadTimes OpenThread IsDebuggerPresent OutputDebugStringW RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW RtlUnwindEx RtlPcToFileHeader SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetStdHandle ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType HeapReAlloc HeapSize FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx WriteConsoleW GetCurrentDirectoryA lstrlenA GetCurrentProcess HeapFree Process32First GetModuleFileNameA ReadFile

advapi32

RegCreateKeyW RegCloseKey RegOpenKeyW RegEnumValueW RegSetValueExW RegQueryValueExW OpenThreadToken ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExW LookupPrivilegeValueW AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

ole32

CoInitialize CoCreateInstance CoUninitialize

shlwapi

SHDeleteKeyW

user32

wsprintfW

oleaut32

SysFreeString

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

384KB

Virtual Size

383KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

127KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-20_fc0ae63726140c3c85e7729b3e7c8c29_cobalt-strike_icedid_luca-stealer_njrat_stealc

kernel32

advapi32

ole32

shlwapi

user32

oleaut32

generic