2026-08-23_b95a0128f6ee972b1a215075f0b8bbef_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-23_b95a0128f6ee972b1a215075f0b8bbef_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 365KB
Sample260823-3qwsfa1end
SHA256 20eccc227eb576aa46a0d36195d304472c0fc3fe69012e8985737804ac34af1d
MD5 b95a0128f6ee972b1a215075f0b8bbef
SHA1 717d03cd44000cc4e93f5690bd229451e1d5cb6d
SHA512 225065410736b7f54c303d7456b7624fc3f494eb57ef3413f323f8c059cb8afc86c68d420b4be57f89911668b239b98fb7ed3ad6afeb2b45dcf3bf97a0934e9a
SSDEEP 6144:syfEjxTS2ao8/jZLXJosrrrkv/xcvH3+0YkU:JfEjxTo7RJourg3qvHu0Y
TLSH
T1C6848E1AFBA504F9E167D174CD624A06EB727C8E07B0EB8F23E056961F235909E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_b95a0128f6ee972b1a215075f0b8bbef_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-23_b95a0128f6ee972b1a215075f0b8bbef_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 365KB

2026-08-23_b95a0128f6ee972b1a215075f0b8bbef_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 7f8236e7230c42bc7473b1bbb2d3a616
SHA256 20eccc227eb576aa46a0d36195d304472c0fc3fe69012e8985737804ac34af1d
MD5 b95a0128f6ee972b1a215075f0b8bbef
SHA1 717d03cd44000cc4e93f5690bd229451e1d5cb6d
SHA512 225065410736b7f54c303d7456b7624fc3f494eb57ef3413f323f8c059cb8afc86c68d420b4be57f89911668b239b98fb7ed3ad6afeb2b45dcf3bf97a0934e9a
SSDEEP 6144:syfEjxTS2ao8/jZLXJosrrrkv/xcvH3+0YkU:JfEjxTo7RJourg3qvHu0Y
TLSH
T1C6848E1AFBA504F9E167D174CD624A06EB727C8E07B0EB8F23E056961F235909E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

116264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

freeaddrinfo __WSAFDIsSet ntohl getsockname ntohs inet_ntoa htonl ioctlsocket getnameinfo gethostname inet_ntop WSACleanup WSAStartup recv WSAGetLastError accept bind closesocket select listen inet_pton getaddrinfo inet_addr send socket connect htons setsockopt

advapi32

GetTokenInformation GetUserNameA OpenProcessToken LookupAccountSidA

iphlpapi

IcmpCloseHandle IcmpSendEcho IcmpCreateFile

secur32

EncryptMessage AcquireCredentialsHandleA DeleteSecurityContext QueryContextAttributesA DecryptMessage InitializeSecurityContextA FreeContextBuffer FreeCredentialsHandle

kernel32

HeapReAlloc ReadConsoleW ReadFile MoveFileExW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx CreateDirectoryW GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW FindFirstFileExW IsValidCodePage GetFileType GetACP EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect Sleep SetConsoleCP SetConsoleOutputCP GetModuleFileNameA TerminateProcess WaitForSingleObject OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar ProcessIdToSessionId GetFileAttributesA Process32NextW Process32FirstW CloseHandle GetNativeSystemInfo WideCharToMultiByte IsWow64Process GetLogicalDrives FindFirstFileW FindNextFileW FindClose MoveFileExA FileTimeToSystemTime DeleteFileA SetFileAttributesA RemoveDirectoryA SystemTimeToTzSpecificLocalTime CreateProcessA FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree GetProcessHeap SetStdHandle CreateFileW HeapSize WriteConsoleW SetEndOfFile SubmitThreadpoolWork ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency SleepConditionVariableSRW GetTickCount64 RtlPcToFileHeader RaiseException IsProcessorFeaturePresent GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork RtlUnwind CloseThreadpoolWork GetModuleHandleExW InitOnceComplete InitOnceBeginInitialize WakeAllConditionVariable InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread ExitProcess GetModuleFileNameW GetStdHandle WriteFile HeapAlloc

user32

ReleaseDC GetSystemMetrics GetDC SetProcessDPIAware

gdi32

CreateCompatibleDC GetObjectA SelectObject DeleteDC CreateCompatibleBitmap DeleteObject GetDIBits BitBlt

Name

.text

Size

247KB

Virtual Size

246KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_b95a0128f6ee972b1a215075f0b8bbef_cobalt-strike_icedid_luca-stealer_njrat_stealc

ws2_32

advapi32

iphlpapi

secur32

kernel32

user32

gdi32

generic