2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 366KB
Sample260824-pmjrtaxfld
SHA256 11f6558bc0bd12697ca40f12790dae20738f1d6c5787de712ec70b0f64dc84de
MD5 4a98c5d10fc5d088f2ba9490de55b4b3
SHA1 2fc4d37b0c1fd93e30f88706dc12e00004170ca7
SHA512 fb4349462eb7a99c7bddc9d8518b5bc775f81564f96fa7d96650aec05894665fa1e161b32cae447f07cfcde1b167c9f142f84620d0f5d78a8508446ddf1aba8f
SSDEEP 6144:TY9lyOjj26zjB8mnc4BzeTqUxZxFz1zR8NYXKt:mkOmG9B5UxZ1zR8
TLSH
T1B8848E16E7A804F9E1B7D178C9634906D7727C9A07A0A7CF33A44A961F23BE05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 366KB

2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH bd9383200820a769498d29b86676b5f9
SHA256 11f6558bc0bd12697ca40f12790dae20738f1d6c5787de712ec70b0f64dc84de
MD5 4a98c5d10fc5d088f2ba9490de55b4b3
SHA1 2fc4d37b0c1fd93e30f88706dc12e00004170ca7
SHA512 fb4349462eb7a99c7bddc9d8518b5bc775f81564f96fa7d96650aec05894665fa1e161b32cae447f07cfcde1b167c9f142f84620d0f5d78a8508446ddf1aba8f
SSDEEP 6144:TY9lyOjj26zjB8mnc4BzeTqUxZxFz1zR8NYXKt:mkOmG9B5UxZ1zR8
TLSH
T1B8848E16E7A804F9E1B7D178C9634906D7727C9A07A0A7CF33A44A961F23BE05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

113892

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

connect inet_ntop inet_pton freeaddrinfo getaddrinfo WSAStartup gethostname socket send recv ntohl htons htonl closesocket

gdi32

SelectObject GetDIBits DeleteObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap BitBlt

user32

GetMessageA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA ReleaseDC GetDC GetSystemMetrics ToAscii GetKeyNameTextA GetKeyboardState DispatchMessageA TranslateMessage

advapi32

RegSetValueExA RegOpenKeyExA RegCloseKey GetUserNameA

shell32

SHGetFolderPathA

kernel32

GetACP IsValidCodePage GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetOEMCP ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW SetStdHandle HeapSize WriteConsoleW SetEndOfFile LCMapStringW ReadFile CloseHandle SetHandleInformation CreatePipe WaitForSingleObject ExitProcess CreateProcessA GetModuleFileNameA GetModuleHandleA GetComputerNameA CreateToolhelp32Snapshot Process32First Process32Next LocalFree FormatMessageA GetLocaleInfoEx QueryPerformanceCounter QueryPerformanceFrequency Sleep GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WideCharToMultiByte CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx RtlUnwind MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime WakeAllConditionVariable EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapAlloc HeapFree HeapReAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect

Name

.text

Size

249KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-23_4a98c5d10fc5d088f2ba9490de55b4b3_cobalt-strike_icedid_luca-stealer_njrat_stealc

ws2_32

gdi32

user32

advapi32

shell32

kernel32

generic