2026-08-26_f8b9cae9ba8ae31783460d265f2a94a8_cobalt-strike_icedid_luca-stealer_njrat_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-26_f8b9cae9ba8ae31783460d265f2a94a8_cobalt-strike_icedid_luca-stealer_njrat_stealc
Size 680KB
Sample260827-bsvvdaydmd
SHA256 dd9b212e389143c1139a9dd691f1ca76a1f8890bf61fb040dcba1fe824add860
MD5 f8b9cae9ba8ae31783460d265f2a94a8
SHA1 430976289a1d135957bbcce6a4e5224c0225e9b7
SHA512 b3d8641cd634c0a16ba16ce98ef6339db6a8ebe0e4b79a023b2ccfdfa796c28f800211167e931a1d5d651a648a7b33203947aaa35bc08fd88031a33295d9688f
SSDEEP 3072:9WYlNsbDEVIbfBYEEn6/HpCTyAWUyEEDFAPUzLseVXQ/dnTVIE7l5YCG9Io2WOyq:9WYsbYVIbfBY2BCThEDF7XsjTVWDl
TLSH
T117E45816E2A510FAEA67C13CC942D536EA327C554760DAEB03E07EA33E336D15E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-26_f8b9cae9ba8ae31783460d265f2a94a8_cobalt-strike_icedid_luca-stealer_njrat_stealc

File Explorer

2026-08-26_f8b9cae9ba8ae31783460d265f2a94a8_cobalt-strike_icedid_luca-stealer_njrat_stealc

.exe 680KB

2026-08-26_f8b9cae9ba8ae31783460d265f2a94a8_cobalt-strike_icedid_luca-stealer_njrat_stealc

IMPHASH 0d5e013bcc58525cfbd508d26a1d03b8
SHA256 dd9b212e389143c1139a9dd691f1ca76a1f8890bf61fb040dcba1fe824add860
MD5 f8b9cae9ba8ae31783460d265f2a94a8
SHA1 430976289a1d135957bbcce6a4e5224c0225e9b7
SHA512 b3d8641cd634c0a16ba16ce98ef6339db6a8ebe0e4b79a023b2ccfdfa796c28f800211167e931a1d5d651a648a7b33203947aaa35bc08fd88031a33295d9688f
SSDEEP 3072:9WYlNsbDEVIbfBYEEn6/HpCTyAWUyEEDFAPUzLseVXQ/dnTVIE7l5YCG9Io2WOyq:9WYsbYVIbfBY2BCThEDF7XsjTVWDl
TLSH
T117E45816E2A510FAEA67C13CC942D536EA327C554760DAEB03E07EA33E336D15E3A711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

86456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

e:\code\windowsproject\MHubDeviceWatcher\x64\Release\MCHOSE HUB Watcher.pdb

hid

HidD_GetHidGuid HidD_GetPreparsedData HidP_GetCaps HidD_SetOutputReport HidD_FreePreparsedData HidD_SetNumInputBuffers HidD_SetFeature

setupapi

SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces

kernel32

GetConsoleMode GetConsoleOutputCP SizeofResource MultiByteToWideChar LockResource LoadResource FindResourceW WriteFile CreateFileW CreateEventW GetLastError CloseHandle ResetEvent GetOverlappedResult ReadFile WaitForSingleObject Sleep OutputDebugStringW SetEvent CancelIoEx GetModuleFileNameW GetFileAttributesW GetCurrentThreadId OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW QueryFullProcessImageNameW GetTickCount CreateDirectoryW GetCommandLineW TerminateProcess SetProcessShutdownParameters CreateMutexW OpenEventW UnmapViewOfFile GetLocalTime LocalFree GetCurrentProcessId CreateProcessW WideCharToMultiByte CreateFileMappingW MapViewOfFile OpenMutexW GetExitCodeProcess IsDebuggerPresent FlushFileBuffers GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree GetStdHandle WriteConsoleW HeapSize ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter WakeAllConditionVariable GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread

user32

RegisterClassW TranslateMessage PostQuitMessage GetWindowThreadProcessId AllowSetForegroundWindow GetWindow IsWindowVisible SetWindowPos keybd_event SetActiveWindow LockSetForegroundWindow SendMessageW PeekMessageW ShowWindow SwitchToThisWindow IsChild AttachThreadInput GetForegroundWindow EnumWindows BringWindowToTop GetClassNameW SystemParametersInfoW SetForegroundWindow IsIconic GetWindowTextW PostMessageW IsWindow RegisterDeviceNotificationW UnregisterDeviceNotification DispatchMessageW CreateWindowExW DestroyWindow DefWindowProcW GetMessageW GetWindowLongPtrW

advapi32

RegSetKeyValueW RegDeleteKeyValueW

shell32

SHGetFolderPathW ShellExecuteW CommandLineToArgvW

Name

.text

Size

196KB

Virtual Size

196KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

378KB

Virtual Size

377KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-26_f8b9cae9ba8ae31783460d265f2a94a8_cobalt-strike_icedid_luca-stealer_njrat_stealc

hid

setupapi

kernel32

user32

advapi32

shell32

generic